1.1 How Data Protection Works in Zambia (Start Here)
Every organisation collects information about people: customers, employees, job applicants, suppliers’ staff, website visitors and people caught on CCTV. Data protection law sets the rules for how that information may be collected, used, shared, kept and destroyed, and gives people rights over it.
This course is for everyone who handles personal data at work, and for suppliers that handle data for their clients, such as payroll bureaus, IT and cloud providers and call centres, because the law places duties on them too.
Why data protection law exists
Personal data is valuable. It lets a business serve customers, pay staff and plan. It is also a liability: when it is lost, stolen, misused or simply kept too long, real people can suffer fraud, discrimination, embarrassment or danger. The law lets organisations use personal data for legitimate purposes, provided they do so fairly, openly and securely, and can prove it.
The data lifecycle
Data protection applies at every stage of the information’s life:
- Collect: decide what you need and tell people why you are collecting it.
- Use: use it only for the purposes you stated, on a lawful basis.
- Store: keep it accurate and secure.
- Share: disclose it only where the law allows, with proper contracts in place.
- Transfer: send it abroad only through an approved route.
- Retain: keep it no longer than you need it.
- Delete: destroy it securely when the retention period ends.
The main roles
| Role | Who it is |
|---|---|
| Data subject | The living person the information is about |
| Controller (data controller) | The organisation that decides why and how personal data is processed |
| Processor (data processor) | An organisation that processes personal data on behalf of a controller, under its instructions |
| Data Protection Officer | The person who oversees data protection compliance inside an organisation |
| Regulator (the ODPC) | The public body that registers organisations, issues guidance, investigates complaints and enforces the law |
The same organisation can be a controller for some data and a processor for other data. A payroll bureau, for example, is the controller of its own employees’ records and a processor of its clients’ payroll data (lesson 1.3).
The data protection laws
| Law | What it governs |
|---|---|
| Data Protection Act No. 3 of 2021 | Processing of personal data, registration, rights, transfers and the ODPC |
| Data Protection (Registration and Licensing) Regulations 2021 (SI 58 of 2021) | Registration tiers, fees and forms, data auditors, records of processing and DPIA forms |
| ODPC Code of Conduct for Data Controllers and Data Processors (2025) | Binding conduct rules, the DPO’s role and dealings with the ODPC |
| Electronic Communications and Transactions Act No. 4 of 2021 | Electronic marketing and online suppliers’ privacy disclosures |
| Cyber Security Act and Cyber Crimes Act, 2025 | Critical information, incident reporting and cyber offences |
| Access to Information Act No. 24 of 2023 | Access to information held by information holders |
In Zambia the regulator is the Office of the Data Protection Commissioner (ODPC), www.dataprotection.gov.zm.
How figures are used in this course
Fines, fees, response times and notification periods in the lessons are examples of the law as at 2026. They are not permanent rules: Zambia changes them through amending Acts, regulations, regulator guidance and court decisions. All the figures are gathered in a Course reference table at the end of lesson 5.4, dated so you can see how old they are.
Before you take a decision that depends on a figure or a deadline, confirm it through official channels.
Example: Bursar Mapalo Banda mapped the personal data held by a Kabwe private school: parents’ contact and fee records, pupils’ reports and medical notes, staff files and gate CCTV. For each she noted why it was collected, where it sat, who saw it, what went to the school’s payroll bureau and IT provider, and when it would be deleted. The map became the school’s first data inventory.
For controllers and processors
- If you are the controller: you are accountable for every stage of the lifecycle, including the stages your suppliers carry out for you.
- If you are a processor or supplier: you handle someone else’s data under their instructions, and the law gives you duties of your own.
Check before you act: Fines, fees and time limits here are 2026 examples, not fixed rules, and are expected to change. Confirm the current position with the ODPC (www.dataprotection.gov.zm), the Government Gazette or a qualified data protection or legal adviser.
Key takeaway
Data protection law lets organisations use personal data for legitimate purposes, provided they handle it fairly, openly and securely at every stage of its life and can prove they do. Controllers decide why and how data is used; processors act for them; the regulator enforces the rules.
Enjoyed this lesson? Get the full course: Data Protection in Zambia: Privacy Law, Rights and Compliance
Unlock every lesson, the module quizzes and your certificate on completion.