ZambiaData Protection Act, 2021, rights of the data subject
Data Protection Act, 2021, ss. 58-61, 63-67 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Let a data subject access, correct, delete, or restrict the personal data held about them.NIST Privacy FrameworkCT.PO-P3
- Answer an access request with the purpose, the categories of data and of recipients, the storage period or the criteria that set it, the data and its source, and the basic logic of any automated decision-making, free of charge for the first copy and in a commonly used electronic format where the request came electronically.NIST Privacy FrameworkCT.DM-P1
- Tell the data subject every third party their personal data has been disclosed to, and what safeguards are in place for it.NIST Privacy FrameworkCM.AW-P4
- Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- Communicate every rectification, erasure or restriction of processing to each recipient the personal data was disclosed to, where practicable.NIST Privacy FrameworkCM.AW-P5
- Give a data subject their personal data in a structured, commonly used, machine readable or otherwise legible format, and transmit it directly to another controller where that is technically or otherwise feasible.NIST Privacy FrameworkCT.DM-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 58 to 67 give the data subject access, rectification, erasure, objection and portability, and section 66 requires the controller to pass a rectification, erasure or restriction on to each recipient of the data where practicable. The right to be told of third parties to whom data was disclosed (section 58(3)) is access to information about the data subject, not a rule that a log be kept, and the record of disclosures is section 51(2), which this row does not cite. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Section 58 gives a data subject confirmation of whether their personal data is being processed and access, in terms they understand, to the purpose, the categories of data and of recipients, the envisaged storage period or the criteria that set it, the data and its source, and the basic logic involved in any automated decision-making, along with notification of every third party the data was disclosed to and the safeguards put in place; the first copy is free and further copies carry a reasonable administrative fee, and an electronic request is answered in a commonly used electronic format.
Section 59 gives a right to rectification of inaccurate personal data as soon as practicable and to completion of incomplete data.
Section 60 gives a right to erasure as soon as practicable, with the controller obliged to erase without undue delay where the data is no longer necessary, where consent is withdrawn and no other ground exists, where the data subject objects and no overriding legitimate ground exists, where the processing was unlawful, or where a legal obligation requires it, and requires reasonable steps to tell processors and third parties processing data the controller made public.
Section 61 gives a right of objection, including an objection to direct marketing that ends processing for that purpose, and requires the rights to be brought to the data subject's attention clearly and separately at the first communication.
Section 63 gives a right to restriction of processing, section 64 fixes the information to be given when personal data is collected directly from the data subject, section 65 gives a right to data portability, and section 66 requires any rectification, erasure or restriction to be communicated to every recipient the data was disclosed to where practicable. Section 1 leaves commencement to a statutory instrument appointed by the Minister.
The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on , which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .