LexLint.ioBeta

Know the law your code answers to.

Law / Zambia

Data Protection Act, 2021, notification of a security breach

Data Protection Act, 2021, s. 49 (notification of a security breach)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
none

What it requires

  • Notify the Data Protection Commissioner within 24 hours of the breach occurring: section 49(1) runs the period from the security breach itself, not from the moment you learn of it.
  • Notify the affected data subject as soon as practicable of any security breach affecting their personal data.
  • As a data processor, notify the data controller as soon as practicable of any security breach affecting personal data you process on its behalf.
  • Treat every security breach affecting personal data as notifiable: the Act sets no risk threshold below which the duty falls away.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
NIST CSF 2.0
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Section 49 requires a controller to notify the Commissioner of a security breach within twenty-four hours, a processor to notify the controller and a controller or processor to notify the data subject. It is a duty to notify and names no documentation or register of breaches, so it is not a record duty. The record of processing activities is section 45 and accountability is section 50, neither cited by this row. The row imposes no log or record duty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 49(1) requires a data controller to notify the Data Protection Commissioner within twenty-four hours of any security breach affecting personal data processed, a period the Act runs from the breach itself rather than from the moment the controller becomes aware of it. Section 49(2) requires a data processor to notify the data controller, as soon as practicable, of any security breach affecting personal data processed on the controller's behalf.

Section 49(3) requires a data controller or data processor to notify the data subject, as soon as practicable, of any security breach affecting personal data processed. None of the three duties is qualified by a risk threshold: the Act attaches them to any security breach affecting personal data, not only to one likely to cause harm. Section 82(2)(b) lets the Minister make regulations on the notification of security breaches, so the detail may be prescribed later.

Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on , which is the day these provisions began to bind.

When LexLint raises it

When your app profile says your app runs an essential service or processes personal data.

Back to the example  ·  Lint your app

Page updated .