ZambiaData Protection Act, 2021, sensitive personal data, children and vulnerable persons
Data Protection Act, 2021, ss. 14 and 17 (sensitive personal data, children and vulnerable persons)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Obtain explicit consent, or rely on another applicable ground, before processing sensitive personal data, including biometric or genetic data, a child's data, political opinions, or health information.
- Process a child's or a vulnerable person's personal data only with the consent of their parent, legal guardian or a person exercising parental responsibility.
- Make every reasonable effort to verify that consent for a child's or a vulnerable person's personal data was given or authorised by that person, taking available technology into account.
- Build appropriate age-verification and parental-consent mechanisms into any processing of a child's personal data.
- Where you rely on the public-interest ground for sensitive personal data, put adequate measures in place first to safeguard the data subject's rights and freedoms, and where you rely on the medical ground, process only by or under the responsibility of a professional bound to secrecy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 14 lists the grounds for processing sensitive personal data and section 17 requires a parent's or guardian's consent for a child's or vulnerable person's data, every reasonable effort to verify it (section 17(3)) and appropriate mechanisms for age verification and parental consent (section 17(4)). Verifying consent and building a mechanism are steps and safeguards, and neither section names a record of the check or of the consent. The duty to demonstrate consent is section 15(4), which this row does not cite. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Section 2 defines sensitive personal data to include genetic data and biometric data, child abuse data, a data subject's political opinions, religious or similar beliefs, trade union membership, and physical or mental health or condition.
Section 14 bars anyone from processing sensitive personal data unless the processing is necessary for the establishment, exercise or defence of a legal claim or for a court exercising a judicial function, necessary for preventive or occupational medicine, assessing an employee's working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, or necessary for reasons of public interest; the medical ground runs only where the processing is by or under the responsibility of a professional subject to secrecy, and the public-interest ground only where adequate measures to safeguard the data subject's rights and freedoms are in place.
Section 17 lets a child's or a vulnerable person's rights be exercised by a parent, legal guardian or person with parental responsibility, bars a data controller from processing their personal data without that person's consent, requires every reasonable effort to verify that the consent was given or authorised taking available technology into account, and requires appropriate mechanisms for age verification and parental consent in processing a child's personal data.
A vulnerable person is someone aged 18 or above whose ability to make informed decisions about their rights and well-being is temporarily or permanently impaired. Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on , which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .