Makes education decisions, in Zambia

Data Protection Act, 2021 (Act No. 3 of 2021), general duties (ss. 1-13, 15-16, 19-48 and 50-57) · Read the law's page

• Before processing personal data, establish a lawful basis such as consent, a contract, a legal obligation, or a legitimate interest, and process it fairly, transparently, and only for the purpose collected.
• Register with the Data Protection Commissioner as a data controller or data processor before controlling or processing personal data.
• Tell a data subject of the right to withdraw consent before they give it, present the request separately from other matters in clear and plain language, be able to prove the consent was given, and destroy immediately every piece of personal data collected after a withdrawal.
• Collect personal data directly from the data subject unless one of the exceptions in section 16(2) applies.
• Keep a written record of your processing activities and of all categories of processing you carry out, and make it available to the Data Protection Commissioner on demand.
• Carry out a data protection impact assessment before processing that uses new technologies and is likely to result in a high risk, and in particular before automated processing including profiling that produces legal effects, large-scale processing of sensitive personal data, or systematic monitoring of a publicly accessible area on a large scale.
• Implement security safeguards proportionate to the risk, including pseudonymisation and encryption, measures against misuse, unauthorised access, modification, disclosure or destruction, and data protection policies, and review them periodically against the Commissioner's guidelines.
• Appoint a data protection officer in accordance with the Commissioner's guidelines.
• Do not disclose personal data without the data subject's consent, and before any disclosure tell them when and to whom it will be disclosed, why, what policies will protect it, and how to complain.
• Tell the Data Protection Commissioner of any third-party agreement that lets a third party trade on a data subject's profile.

Data Protection Act, 2021, s. 62 (automated individual decisions) · Read the law's page

• Do not subject a data subject to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.
• Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.

Data Protection Act, 2021, ss. 58-61, 63-67 (rights of the data subject) · Read the law's page

• Let a data subject access, correct, delete, or restrict the personal data held about them.
• Answer an access request with the purpose, the categories of data and of recipients, the storage period or the criteria that set it, the data and its source, and the basic logic of any automated decision-making, free of charge for the first copy and in a commonly used electronic format where the request came electronically.
• Tell the data subject every third party their personal data has been disclosed to, and what safeguards are in place for it.
• Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.
• Communicate every rectification, erasure or restriction of processing to each recipient the personal data was disclosed to, where practicable.
• Give a data subject their personal data in a structured, commonly used, machine readable or otherwise legible format, and transmit it directly to another controller where that is technically or otherwise feasible.