Data protection
The Data Protection Act 2021 sets a full framework with registration of data controllers, and the regulator is still building capacity.
Protection rests on the Data Protection Act 2021, which introduced a comprehensive framework with registration of data controllers. Implementation has been progressive, with the regulator building capacity since the Act's commencement.
Key points
| Data localisation | Certain sensitive personal data must be processed within the country |
|---|---|
| Data protection officer | Required for certain controllers |
| Enforcement | Through the Commissioner under the responsible ministry |
In practice
- Ask where your data is stored: localisation requirements apply to sensitive categories.
- Complain in writing to the Commissioner with dates and copies.
Worth knowing
Zambia's localisation requirement is unusual and affects cloud services. Organisations relying on offshore processing of sensitive data may be in breach.
The general article: Data protection · Compare with another country
Privacy
Article 17 of the Constitution protects against arbitrary search and interference with correspondence. The Data Protection Act 2021 introduced controller registration, data subject rights and breach notification, alongside cyber security and cyber crimes legislation that was itself replaced in 2025.
Zambia's Constitution protects privacy of the person, home and communications, and the Data Protection Act of 2021 introduced a modern framework with rights of access, correction and erasure, a data protection commissioner and breach notification. The Cyber Security and Cyber Crimes legislation, adopted at the same time, criminalises unlawful disclosure and harassment but drew criticism for its surveillance provisions.
Key points
| Constitution | Article 17: protection for privacy of home and other property |
|---|---|
| Statute | Data Protection Act 2021 |
| Regulator | Data Protection Commissioner under the responsible ministry |
| Registration | Required for data controllers, with licensing of auditors |
| Localisation | Certain sensitive personal data must be processed within Zambia |
| Cyber legislation | Revised in 2025, replacing the 2021 cyber security and cyber crimes framework |
| Surveillance concerns | The cyber framework has been criticised for broad interception powers |
In practice
- Ask where your data is stored: offshore processing of sensitive data may itself be unlawful.
Where to go
- Human Rights Commission.
- Legal Aid Board.
Worth knowing
Zambia's cyber legislation has changed recently and has been criticised for broad surveillance powers: take advice before publishing anything sensitive online. The localisation rule is unusual in the region and gives a concrete ground of complaint where a service stores sensitive data abroad.
Frequently asked questions
What did the Data Protection Act 2021 introduce?
Rights of access, correction and erasure, obligations to process lawfully and to notify breaches, a requirement for data controllers to register, and a commissioner with enforcement powers. It is closely modelled on international frameworks, though supervisory capacity is still being built.
Image rights
Zambia's cyber legislation, first enacted in 2021 and replaced by new cyber security and cyber crimes statutes in 2025, criminalises cyber harassment, the transmission of obscene material and related conduct. The Data Protection Act 2021 applies to identifiable images, and the Penal Code covers extortion.
Key points
| Statute | Cyber crimes legislation, renewed in 2025 |
|---|---|
| Offences | Cyber harassment, transmission of obscene material, extortion |
| Data protection | Data Protection Act 2021 |
| Reporting | Zambia Police cybercrime unit, and the national CIRT |
| Concerns | The framework has been criticised for broad surveillance powers |
| Constitution | Article 17 protects privacy of home and correspondence |
| Framework renewed | The applicable offence depends on the date of the incident |
| Extortion | Separately punishable under the penal code |
| Legal aid | Available through the Legal Aid Board and NGOs |
In practice
- Bring the exact dates to whoever advises you: the legislation changed in 2025.
Where to go
- Human Rights Commission.
- Legal Aid Board and Women in Law and Development in Africa.
Worth knowing
The legislation changed in 2025 and the offence you rely on depends on when the incident occurred: bring the dates to whoever advises you. Because the cyber statutes were replaced in 2025, the offence that applies depends on when the sharing occurred.
The general article: Image rights · Compare with another country
Speech and online harassment
Cyber harassment and the distribution of intimate images are offences, and criminal defamation of the President was repealed in 2022.
The framework rests on the Cyber Security and Cyber Crimes legislation, which criminalises cyber harassment and the distribution of intimate images, alongside civil defamation. Criminal defamation of the President was repealed in 2022, a significant free expression reform.
Key points
| Defamation of the President repealed | Removed from the penal code in 2022 |
|---|---|
| Cyber legislation | Renewed in 2025, with offences covering harassment and false information |
| Civil defamation | Available in the High Court |
| Concerns | The cyber framework has been criticised for breadth and surveillance powers |
In practice
- Preserve evidence carefully; the offences turn on the precise content and its reach.
- For reputational harm, civil proceedings remain available.
Where to go
- Zambia Information and Communications Technology Authority.
- Bloggers of Zambia and other digital rights organisations.
Worth knowing
The offence of defaming the President was repealed in 2022, but broadly drafted cyber offences have replaced it as the main risk for online speech.
The general article: Speech and online harassment · Compare with another country
Copyright
Administration falls to the Registrar of Copyright within the responsible ministry, and collective management is handled by licensed societies.
Zambia's Copyright and Performance Rights Act protects works for the author's life plus fifty years and provides for a registration system and for collecting societies to administer music and performance rights. Enforcement action tends to focus on physical piracy and on public performance licensing; online infringement is harder to pursue and the practical remedy is usually a takedown request to the platform.
Key points
| Statute | Copyright and Performance Rights Act |
|---|---|
| Administration | Registrar of Copyright |
| Collective management | Licensed societies for music and performance rights |
| Enforcement | Registrar's office and the High Court |
| Registrar of Copyright | Administers the system within the responsible ministry |
| Criminal enforcement | Available for commercial-scale infringement |
In practice
- Keep dated drafts and file metadata: there is no registration certificate to rely on.
Where to go
- Registrar of Copyright.
- Zambia Music Copyright Protection Society.
- High Court commercial list.
Worth knowing
Keep dated evidence of creation — drafts, files with metadata, correspondence — because there is no registration certificate to fall back on. With no registration system, contemporaneous evidence of creation is the only proof of authorship available.
Frequently asked questions
Do you need to register a work in Zambia?
No. Protection arises automatically on creation, as in every country party to the Berne Convention. Registration with the copyright office is optional but provides useful evidence of authorship and date, which matters if ownership is ever disputed.
The general article: Copyright · Compare with another country
Identity theft
Cyber crimes legislation and penal code fraud offences, with mobile money reversals depending entirely on speed.
Zambia's cyber crimes legislation, renewed in 2025, covers computer-related fraud and identity misuse, alongside penal code offences of obtaining by false pretences. The Bank of Zambia and mobile operators handle transaction disputes, and reporting within the first hours is what determines whether funds can be held.
Key points
| Statutes | Cyber crimes legislation renewed in 2025, plus penal code fraud offences |
|---|---|
| Mobile money | Report to the operator immediately for any chance of reversal |
| Data protection | Data Protection Act 2021 |
| Banking | Bank of Zambia for unresolved complaints |
| Documents | Report a lost NRC to the Department of National Registration |
In practice
- Call the mobile money operator's fraud line first; every minute reduces the chance of recovery.
- Open a police case and obtain the report number.
- Write to your bank and ask for a formal investigation.
- Report a lost National Registration Card without delay.
Where to go
- Zambia Police Service cybercrime unit.
- Bank of Zambia complaints.
- Data Protection Commissioner.
Worth knowing
Keep the transaction reference numbers: without them an operator will usually not be able to trace or reverse anything.
The general article: Identity theft · Compare with another country
Online shopping
The Competition and Consumer Protection Act 2010 lets a commission order refunds, and the Commission takes complaints directly.
Protection comes from the Competition and Consumer Protection Act 2010, enforced by a commission that can order refunds and impose penalties. The Commission accepts complaints directly and has acted against online and telecom providers.
Key points
| Competition and Consumer Protection Act 2010 | Covers unfair trading and defective goods |
|---|---|
| CCPC | The Commission investigates consumer complaints and can order redress |
| Right to redress | Includes repair, replacement or refund for defective goods |
In practice
- File a complaint with the Competition and Consumer Protection Commission; it is free.
- Keep receipts and delivery records; the Commission works from documents.
Where to go
- Competition and Consumer Protection Commission.
- Bank of Zambia for payment disputes.
- Zambia Information and Communications Technology Authority.
Worth knowing
The Commission can order a trader to refund or replace goods. Its process is administrative and does not require a lawyer.
The general article: Online shopping · Compare with another country
Romance scams
A cyber security agency with an incident response team, and police cybercrime investigation.
A national cyber security agency operates an incident response team taking reports of online fraud, alongside the police cybercrime unit. Mobile money providers can block a transfer if contacted before withdrawal.
Where to go
- National cyber security incident response team
- Mobile money provider, immediately
Sources
- ZICTA — 7070 — toll-free line and *707# short code to report scam numbers; reported SIMs are deactivated
- Zambia Police Service — nearest station — criminal complaint; ZM-CIRT handles the technical side
- Your mobile money provider's fraud line — the fastest lever: call before the funds are withdrawn
- eConsumer.gov — international channel for scams committed from abroad
The general article: Romance scams · Compare with another country