The legal framework
Article 17 of the Constitution protects against arbitrary search and interference with correspondence. The Data Protection Act 2021 introduced controller registration, data subject rights and breach notification, alongside cyber security and cyber crimes legislation that was itself replaced in 2025.
Zambia's Constitution protects privacy of the person, home and communications, and the Data Protection Act of 2021 introduced a modern framework with rights of access, correction and erasure, a data protection commissioner and breach notification. The Cyber Security and Cyber Crimes legislation, adopted at the same time, criminalises unlawful disclosure and harassment but drew criticism for its surveillance provisions.
Key points
| Constitution | Article 17: protection for privacy of home and other property |
|---|---|
| Statute | Data Protection Act 2021 |
| Regulator | Data Protection Commissioner under the responsible ministry |
| Registration | Required for data controllers, with licensing of auditors |
| Localisation | Certain sensitive personal data must be processed within Zambia |
| Cyber legislation | Revised in 2025, replacing the 2021 cyber security and cyber crimes framework |
| Surveillance concerns | The cyber framework has been criticised for broad interception powers |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- Ask where your data is stored: offshore processing of sensitive data may itself be unlawful.
Where to go
- Office of the Data Protection Commissioner.
- Human Rights Commission.
- Legal Aid Board.
Worth knowing
Zambia's cyber legislation has changed recently and has been criticised for broad surveillance powers: take advice before publishing anything sensitive online. The localisation rule is unusual in the region and gives a concrete ground of complaint where a service stores sensitive data abroad.
Frequently asked questions
What did the Data Protection Act 2021 introduce?
Rights of access, correction and erasure, obligations to process lawfully and to notify breaches, a requirement for data controllers to register, and a commissioner with enforcement powers. It is closely modelled on international frameworks, though supervisory capacity is still being built.
What can you do if a former partner shares private material?
Save the evidence first — screenshots with the address, the date and the account name — then report it to the platform, which is the fastest route to removal. Send a written demand to stop and to delete. Where the material is intimate, check whether a specific criminal offence applies, and whether a protection order is available: in several jurisdictions a court can prohibit further publication within days, which is quicker than any damages claim.
Official sources and links
- UN Human Rights Office — ratified treaties and country reviews
- ILO NATLEX — national legislation database