ZambiaCyber Security Act, Reporting of Cyber Security Incidents
Cyber Security Act, 2025 (Act No. 3 of 2025), s. 17
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a controller, meaning a person who controls or is responsible for critical information or critical information infrastructure that the Zambia Cyber Security Agency has designated by notice in the Gazette and that is registered under the Act (reached by declaring that you operate an essential service).
- Immediately notify the Agency, in the manner it determines, of a perceived or actual cyber security incident in respect of critical information or critical information infrastructure, or in respect of any computer system under your control that is interconnected or communicates with it (section 17(1)).
- Submit a preliminary cyber incident report to the Agency within twelve hours of notifying the Agency of the incident (section 17(2)).
- Submit a detailed cyber security incident report to the Agency as soon as the incident is resolved, and a status report at the intervals the Agency determines (section 17(3) and (4)).
- Establish mechanisms and processes, in accordance with the information security standards the Agency publishes in the Gazette, to detect a cyber security threat in respect of critical information or critical information infrastructure (section 17(5)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
A controller who contravenes section 17 commits an offence and is liable on conviction to a fine not exceeding five hundred thousand penalty units or to imprisonment for a term not exceeding five years, or to both (section 17(6)).
Who enforces it
Enforcement body
The Zambia Cyber Security Agency, established in the Office of the President.
Settledness
- As of
- Open questions
- In what manner and form has the Agency determined that an incident notification and the preliminary report must be made under section 17 of the Act?
What this law does
Section 17(1) of the Act requires a controller to notify the Agency immediately of a perceived or actual cyber security incident in respect of critical information or critical information infrastructure. Section 17(1)(b) of the Act extends the duty to notify the Agency to a cyber security incident in respect of any computer system under the controller's control that is interconnected or communicates with critical information or critical information infrastructure.
Section 17(2) of the Act requires a controller to submit a preliminary cyber incident report to the Agency within twelve hours of notifying the Agency of the incident. Section 17(3) of the Act requires a controller to submit a detailed cyber security incident report to the Agency as soon as the incident is resolved.
Section 17(6) of the Act makes a controller who contravenes section 17 liable on conviction to a fine not exceeding five hundred thousand penalty units or imprisonment not exceeding five years, or both.
When LexLint raises it
When your app profile says your app runs an essential service.