ZambiaData Protection Act, 2021, offences, penalties, complaints and redress
Data Protection Act, 2021, ss. 18, 55 and 68-77 (offences, penalties, complaints and redress)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- Expect a data subject to be able to complain to the Data Protection Commissioner about your processing, and to appeal the Commissioner's decision to the High Court within thirty days of it.
- Expect a data subject who suffered damage from an infringement to be able to claim compensation from you as a court determines.
- Expect the Data Protection Commissioner or a licensed independent data auditor to audit your policies and your processing of personal data annually, and to bear the cost of auditing any server you were authorised to keep outside the Republic.
- Note that a director, manager, shareholder or partner who knew of, consented to or connived in an offence under the Act is personally liable to the penalty specified for it.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A natural person convicted of contravening the Part VIII duties of a data controller is liable to a fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to ten years, or both (s. 55(2)).
Penalty structure
Applies to a body corporate that contravenes the Part IV processing principles (s. 18(1)); stated in the Act as one hundred million penalty units, valued at ZMW 0.40 each under the Fees and Fines (Fee and Penalty Unit Value) (Amendment) Regulations, 2024. A natural person instead faces a fixed fine of up to one million penalty units (ZMW 400,000) or imprisonment of up to five years, or both (s. 18(2)), and a residual general penalty of up to three hundred thousand penalty units (ZMW 120,000) or three years' imprisonment applies under s. 77 to an offence under the Act with no specified penalty.
- Rule
- Higher of
- As of
- Currency
- ZMW
- Fixed cap
- 40,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Office of the Data Protection Commissioner
Settledness
- As of
- Open questions
- Does section 72 compensation for damage from an infringement of a data subject's right under the Act reach damage caused by any contravention of the Act, or only by a breach of the rights in Part IX?
What it makes you log
Logging duty
Sections 18, 55 and 68 to 77 set the offences and penalties, the complaint to the Commissioner (section 68), the appeal to the High Court (section 69), compensation (section 72), the Commissioner's power to compound offences (section 74) and forfeiture (section 75). They name no record a controller must keep. The inspectors' power to inspect, examine and audit documents, books and records is section 8, and the annual audit is section 81; neither is in the cited sections, so no audit value is coded. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Section 18(1) makes a body corporate that contravenes the Part IV processing principles liable on conviction to a fine of up to one hundred million penalty units, valued at ZMW 0.40 each since , or two percent of annual turnover of the preceding financial year, whichever is higher; section 18(2) makes a natural person liable instead to a fine of up to one million penalty units or imprisonment of up to five years, or both.
Section 55 sets the same two-percent-or-two-million-penalty-unit structure for the Part VIII duties of a data controller, with ten years' imprisonment for a natural person. Section 68 lets a data subject lodge a complaint with the Data Protection Commissioner, and section 69 lets a person aggrieved by the Commissioner's decision appeal to the High Court within thirty days of it.
Section 72 entitles a data subject who has suffered damage from an infringement to compensation from the data controller or data processor as a court determines.
Section 73 makes unlawfully disclosing sensitive personal data an offence carrying up to two hundred thousand penalty units or two years' imprisonment, section 74 lets the Commissioner compound an offence for up to half the maximum fine, section 75 lets a court order forfeiture of the medium holding the data and bar the convicted person from managing any processing for a period, section 76 reaches a director, manager, shareholder or partner who knew of, consented to or connived in the offence, and section 77 sets a residual penalty of up to three hundred thousand penalty units or three years' imprisonment where no specific penalty is provided.
Section 81 has the Commissioner or a licensed independent data auditor audit a data controller's policies and processing annually. Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on , which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .