Processes personal data, in Zambia

Data Protection Act, 2021 (Act No. 3 of 2021), general duties (ss. 1-13, 15-16, 19-48 and 50-57) · Read the law's page

• Before processing personal data, establish a lawful basis such as consent, a contract, a legal obligation, or a legitimate interest, and process it fairly, transparently, and only for the purpose collected.
• Register with the Data Protection Commissioner as a data controller or data processor before controlling or processing personal data.
• Tell a data subject of the right to withdraw consent before they give it, present the request separately from other matters in clear and plain language, be able to prove the consent was given, and destroy immediately every piece of personal data collected after a withdrawal.
• Collect personal data directly from the data subject unless one of the exceptions in section 16(2) applies.
• Keep a written record of your processing activities and of all categories of processing you carry out, and make it available to the Data Protection Commissioner on demand.
• Carry out a data protection impact assessment before processing that uses new technologies and is likely to result in a high risk, and in particular before automated processing including profiling that produces legal effects, large-scale processing of sensitive personal data, or systematic monitoring of a publicly accessible area on a large scale.
• Implement security safeguards proportionate to the risk, including pseudonymisation and encryption, measures against misuse, unauthorised access, modification, disclosure or destruction, and data protection policies, and review them periodically against the Commissioner's guidelines.
• Appoint a data protection officer in accordance with the Commissioner's guidelines.
• Do not disclose personal data without the data subject's consent, and before any disclosure tell them when and to whom it will be disclosed, why, what policies will protect it, and how to complain.
• Tell the Data Protection Commissioner of any third-party agreement that lets a third party trade on a data subject's profile.

Data Protection Act, 2021, s. 49 (notification of a security breach) · Read the law's page

• Notify the Data Protection Commissioner within 24 hours of the breach occurring: section 49(1) runs the period from the security breach itself, not from the moment you learn of it.
• Notify the affected data subject as soon as practicable of any security breach affecting their personal data.
• As a data processor, notify the data controller as soon as practicable of any security breach affecting personal data you process on its behalf.
• Treat every security breach affecting personal data as notifiable: the Act sets no risk threshold below which the duty falls away.

Data Protection Act, 2021, ss. 14 and 17 (sensitive personal data, children and vulnerable persons) · Read the law's page

• Obtain explicit consent, or rely on another applicable ground, before processing sensitive personal data, including biometric or genetic data, a child's data, political opinions, or health information.
• Process a child's or a vulnerable person's personal data only with the consent of their parent, legal guardian or a person exercising parental responsibility.
• Make every reasonable effort to verify that consent for a child's or a vulnerable person's personal data was given or authorised by that person, taking available technology into account.
• Build appropriate age-verification and parental-consent mechanisms into any processing of a child's personal data.
• Where you rely on the public-interest ground for sensitive personal data, put adequate measures in place first to safeguard the data subject's rights and freedoms, and where you rely on the medical ground, process only by or under the responsibility of a professional bound to secrecy.

Data Protection Act, 2021, ss. 18, 55 and 68-77 (offences, penalties, complaints and redress) · Read the law's page

• Expect a data subject to be able to complain to the Data Protection Commissioner about your processing, and to appeal the Commissioner's decision to the High Court within thirty days of it.
• Expect a data subject who suffered damage from an infringement to be able to claim compensation from you as a court determines.
• Expect the Data Protection Commissioner or a licensed independent data auditor to audit your policies and your processing of personal data annually, and to bear the cost of auditing any server you were authorised to keep outside the Republic.
• Note that a director, manager, shareholder or partner who knew of, consented to or connived in an offence under the Act is personally liable to the penalty specified for it.

Data Protection Act, 2021, ss. 58-61, 63-67 (rights of the data subject) · Read the law's page

• Let a data subject access, correct, delete, or restrict the personal data held about them.
• Answer an access request with the purpose, the categories of data and of recipients, the storage period or the criteria that set it, the data and its source, and the basic logic of any automated decision-making, free of charge for the first copy and in a commonly used electronic format where the request came electronically.
• Tell the data subject every third party their personal data has been disclosed to, and what safeguards are in place for it.
• Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.
• Communicate every rectification, erasure or restriction of processing to each recipient the personal data was disclosed to, where practicable.
• Give a data subject their personal data in a structured, commonly used, machine readable or otherwise legible format, and transmit it directly to another controller where that is technically or otherwise feasible.

Data Protection Act, 2021, ss. 70-71 (transfer of personal data outside the Republic) · Read the law's page

• Store and process personal data on a server or data centre located in Zambia unless the Minister has prescribed an exception, and do not store sensitive personal data outside Zambia without the data subject's explicit consent.
• Where you transfer personal data abroad under a standard contract or intra-group scheme the Commissioner approved, certify and periodically report to the Commissioner that the transfer is made under it, and carry the liability for harm caused by the transferee's non-compliance.
• Rely on the emergency route only for a person or entity providing health or emergency services, and on the country-or-organisation route only where the Commissioner is satisfied the transfer does not hamper enforcement of the Act.