The Office of the Data Protection Commissioner (ODPC) is now fully operational, enforcing privacy and data protection compliance in Zambia.
On 1 April 2021, Zambia’s data protection legislation, the Data Protection Act 2021 (DPA), came into force. The DPA, among other things, seeks to establish a robust framework that governs the collection, use, processing, storage, and transmission of personal data, ensuring its protection throughout these processes. It also regulates the activities of data controllers and processors to promote transparency, accountability and security in the handling of personal information.
Two years later, in June 2023, the country’s first Data Protection Commissioner was appointed as required by the DPA.
The complete operationalisation of the ODPC is a significant milestone in Zambia’s developing privacy and data protection framework. So far, the ODPC has issued essential regulations and guidelines in compliance with the Commissioner’s jurisdiction under the DPA.
The ODPC has also initiated the online registration process for data controllers and processors, requiring all data processors and controllers to register by 30 April 2025. Failing to register by the stated date is an offence punishable by a fine of ZMW 200 000 (approximately USD 7 186) and/ or imprisonment of up to five years.
We anticipate that enforcement will follow in due course. Therefore, data controllers and processors are urged to promptly assess their compliance status and align with these requirements to mitigate the risk of potential enforcement actions.
If you require assistance or further guidance on navigating these obligations, please contact a partner in our Zambian Practice.
