Runs an essential service, in Zambia

Data Protection Act, 2021, s. 49 (notification of a security breach) · Read the law's page

• Notify the Data Protection Commissioner within 24 hours of the breach occurring: section 49(1) runs the period from the security breach itself, not from the moment you learn of it.
• Notify the affected data subject as soon as practicable of any security breach affecting their personal data.
• As a data processor, notify the data controller as soon as practicable of any security breach affecting personal data you process on its behalf.
• Treat every security breach affecting personal data as notifiable: the Act sets no risk threshold below which the duty falls away.

Cyber Security Act, 2025 (Act No. 3 of 2025), s. 17 · Read the law's page

• This binds a controller, meaning a person who controls or is responsible for critical information or critical information infrastructure that the Zambia Cyber Security Agency has designated by notice in the Gazette and that is registered under the Act (reached by declaring that you operate an essential service).
• Immediately notify the Agency, in the manner it determines, of a perceived or actual cyber security incident in respect of critical information or critical information infrastructure, or in respect of any computer system under your control that is interconnected or communicates with it (section 17(1)).
• Submit a preliminary cyber incident report to the Agency within twelve hours of notifying the Agency of the incident (section 17(2)).
• Submit a detailed cyber security incident report to the Agency as soon as the incident is resolved, and a status report at the intervals the Agency determines (section 17(3) and (4)).
• Establish mechanisms and processes, in accordance with the information security standards the Agency publishes in the Gazette, to detect a cyber security threat in respect of critical information or critical information infrastructure (section 17(5)).

Cyber Security Act, 2025 (Act No. 3 of 2025), ss. 8-16, 19 and 64 · Read the law's page

• This binds a controller, meaning a person who controls or is responsible for critical information or critical information infrastructure that the Zambia Cyber Security Agency has designated by notice in the Gazette as relevant to a critical sector and that is registered under the Act (reached by declaring that you operate an essential service).
• Comply with the baseline security requirements prescribed for designated critical information or critical information infrastructure (section 9(2)).
• Register the designated critical information or critical information infrastructure with the Agency within thirty days of the designation (section 11(1)).
• Host critical information or critical information infrastructure within Zambia unless the Agency authorises hosting outside the Republic (section 12).
• Notify the Agency within seven days of any change of ownership of the critical information or critical information infrastructure (section 13(1)).
• Appoint an information technology auditor every year to perform a cyber audit on the critical information or critical information infrastructure, and remedy within the period the Agency states any non-compliance it notifies in writing (sections 14(1) and 15).
• Submit to the Agency a report on cyber security situational awareness in the manner it determines, and submit annually the information it determines (sections 16 and 64).
• Take part in a national cyber security exercise when the Agency directs you to in writing (section 19(3)).