LexLint.ioBeta

Know the law your code answers to.

Law / Zambia

Data Protection Act, 2021, personal data processing framework

Data Protection Act, 2021 (Act No. 3 of 2021), general duties (ss. 1-13, 15-16, 19-48 and 50-57)

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Consent, Security, Retention, Governance, DPIA, Disclosure
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Before processing personal data, establish a lawful basis such as consent, a contract, a legal obligation, or a legitimate interest, and process it fairly, transparently, and only for the purpose collected.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
  • Register with the Data Protection Commissioner as a data controller or data processor before controlling or processing personal data.NIST Privacy FrameworkGV.PO-P5
  • Tell a data subject of the right to withdraw consent before they give it, present the request separately from other matters in clear and plain language, be able to prove the consent was given, and destroy immediately every piece of personal data collected after a withdrawal.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DM-P5
  • Collect personal data directly from the data subject unless one of the exceptions in section 16(2) applies.NIST Privacy FrameworkGV.PO-P1
  • Keep a written record of your processing activities and of all categories of processing you carry out, and make it available to the Data Protection Commissioner on demand.NIST Privacy FrameworkID.IM-P4
  • Carry out a data protection impact assessment before processing that uses new technologies and is likely to result in a high risk, and in particular before automated processing including profiling that produces legal effects, large-scale processing of sensitive personal data, or systematic monitoring of a publicly accessible area on a large scale.NIST Privacy FrameworkID.RA-P4
  • Implement security safeguards proportionate to the risk, including pseudonymisation and encryption, measures against misuse, unauthorised access, modification, disclosure or destruction, and data protection policies, and review them periodically against the Commissioner's guidelines.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P1
  • Appoint a data protection officer in accordance with the Commissioner's guidelines.NIST Privacy FrameworkGV.PO-P3
  • Do not disclose personal data without the data subject's consent, and before any disclosure tell them when and to whom it will be disclosed, why, what policies will protect it, and how to complain.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
  • Tell the Data Protection Commissioner of any third-party agreement that lets a third party trade on a data subject's profile.NIST Privacy FrameworkGV.PO-P5

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.IM-P4Data actions of the systems/products/services are inventoried.
  • ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
3 more
  • CT.DM-P5Data are destroyed according to policy.
  • CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
FINOS AIGF
7 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

What the log must hold

Event time

Logging duty

Section 45(1) requires a data controller to keep and maintain, in writing, a record of its processing activities and meta data, and section 45(2) requires the record to be made available to the Commissioner on demand. Section 51(2) adds a record of the process, the purpose of collection and the third parties to whom, and when, the data was disclosed, and section 15(4) requires a controller relying on consent to demonstrate it, which implies a kept consent record. Section 50(b) asks for internal mechanisms for demonstrating compliance to data subjects and the Commissioner, which is not itself a record. The one-year minimum in section 51(1) is a rule for keeping the personal information, not a period for the record, so no retention is coded. The annual audit of a controller's policies and processing is section 81, and the inspectors' power to audit documents, books and records is section 8; neither is in the cited sections, so the audit value is the on-demand access of section 45(2). Section 3 sets the Act's scope without a territorial hook, and section 70's server-location rule turns on where the data is stored, so the hook is empty.

Kind
Explicit
As of
Provision
Section 45 (written record of processing activities), with section 15(4) (the controller must demonstrate consent) and section 51(2) (a record of the process, its purpose and the third parties to whom data was disclosed)
Trigger
  • personal_data_processing
  • consent_or_optout

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 3 applies the Act to processing personal data wholly or partly by automated means and to processing otherwise than by electronic means, and exempts only an individual's processing for personal use.

Section 12 sets the principles: personal data is to be processed lawfully, fairly and transparently, collected for explicit, specified and legitimate purposes and not further processed incompatibly with them, adequate, relevant and limited to what those purposes need, accurate and kept up to date with inaccurate data erased or rectified without delay, stored in identifiable form no longer than necessary, processed in accordance with the data subject's rights, and secured by appropriate technical or organisational measures against unauthorised or unlawful processing and against loss, destruction or damage.

Section 13 lists the grounds on which a data controller may process, and section 15 requires consent, with the data subject told of the right to withdraw it beforehand, the request presented separately from other matters in clear and plain language, the burden of proving consent on the controller, and everything collected after a withdrawal destroyed immediately. Section 16 requires collection directly from the data subject unless one of its listed exceptions applies.

Section 19 bars controlling or processing personal data without registration, and sections 20 to 28 govern that registration while sections 29 to 38 license data auditors.

Section 45 requires a written record of processing activities, available to the Commissioner on demand; section 46 requires a data protection impact assessment before high-risk processing using new technologies; section 47 requires security safeguards including pseudonymisation and encryption and a periodic review of them; section 48 requires a data protection officer; section 51 sets data retention; section 52 governs the engagement of a data processor; section 53 bars disclosure without the data subject's consent outside the grounds it lists; section 54 makes joint controllers jointly and severally liable; and section 57 requires notice to the Commissioner of any third-party agreement allowing a third party to trade on a data subject's profile.

Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on , which is the day these provisions began to bind.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions or processes personal data.

Back to the example  ·  Lint your app

Page updated .