ZambiaCyber Security Act, Critical Information Infrastructure Regime
Cyber Security Act, 2025 (Act No. 3 of 2025), ss. 8-16, 19 and 64
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Licensing
As of .
What it requires
- This binds a controller, meaning a person who controls or is responsible for critical information or critical information infrastructure that the Zambia Cyber Security Agency has designated by notice in the Gazette as relevant to a critical sector and that is registered under the Act (reached by declaring that you operate an essential service).
- Comply with the baseline security requirements prescribed for designated critical information or critical information infrastructure (section 9(2)).
- Register the designated critical information or critical information infrastructure with the Agency within thirty days of the designation (section 11(1)).
- Host critical information or critical information infrastructure within Zambia unless the Agency authorises hosting outside the Republic (section 12).
- Notify the Agency within seven days of any change of ownership of the critical information or critical information infrastructure (section 13(1)).
- Appoint an information technology auditor every year to perform a cyber audit on the critical information or critical information infrastructure, and remedy within the period the Agency states any non-compliance it notifies in writing (sections 14(1) and 15).
- Submit to the Agency a report on cyber security situational awareness in the manner it determines, and submit annually the information it determines (sections 16 and 64).
- Take part in a national cyber security exercise when the Agency directs you to in writing (section 19(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
A controller who contravenes section 14, the annual cyber audit duty, commits an offence and is liable on conviction to a fine not exceeding three million penalty units (section 14(5)).
Who enforces it
Enforcement body
The Zambia Cyber Security Agency, established in the Office of the President.
Settledness
- As of
- Open questions
- Which information and infrastructure has the Agency designated by notice in the Gazette, and which baseline security requirements have been prescribed under section 9(2) of the Act?
What this law does
Section 9(1) of the Act has the Zambia Cyber Security Agency designate, by notice in the Gazette, information or information infrastructure relevant to a critical sector as critical information or critical information infrastructure. Section 8 of the Act includes among the critical sectors defence and security, the public sector, banking and finance, health, transport, pensions and insurance, information and communications technology, energy, education and mining.
Section 9(2) of the Act requires a controller of designated critical information or critical information infrastructure to comply with the baseline security requirements as may be prescribed. Section 11(1) of the Act requires a controller to register designated critical information or critical information infrastructure with the Agency within thirty days of the designation.
Section 12(1) of the Act requires a controller to host critical information or critical information infrastructure within the Republic, and section 12(2) lets the Agency authorise hosting outside the Republic. Section 14(1) of the Act requires a controller to appoint an information technology auditor each year to perform a cyber audit on critical information or critical information infrastructure.
Section 16 of the Act requires a controller to submit to the Agency a report on cyber security situational awareness in a manner determined by the Agency. Section 14(5) of the Act makes a controller who contravenes section 14 liable on conviction to a fine not exceeding three million penalty units.
When LexLint raises it
When your app profile says your app runs an essential service.