ZambiaData Protection Act, 2021, transfer of personal data outside the Republic
Data Protection Act, 2021, ss. 70-71 (transfer of personal data outside the Republic)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Store and process personal data on a server or data centre located in Zambia unless the Minister has prescribed an exception, and do not store sensitive personal data outside Zambia without the data subject's explicit consent.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.IM-P7
- Where you transfer personal data abroad under a standard contract or intra-group scheme the Commissioner approved, certify and periodically report to the Commissioner that the transfer is made under it, and carry the liability for harm caused by the transferee's non-compliance.NIST Privacy FrameworkCT.PO-P2
- Rely on the emergency route only for a person or entity providing health or emergency services, and on the country-or-organisation route only where the Commissioner is satisfied the transfer does not hamper enforcement of the Act.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 70 requires personal data to be processed and stored on a server or data centre in Zambia and section 71 sets the conditions for a transfer abroad. Section 71(6) requires a controller transferring under a standard contract or intragroup scheme to certify, and periodically report to the Commissioner, that the transfer follows that contract; that is a certification the controller files, not a kept record, and a party's own report is not an audit. Section 71(3) has the Commissioner monitor transferred data. A rule on where data is stored is not a territorial hook, so the hook is empty. The row imposes no log or record duty.
- Kind
- None
- As of
What this law does
Section 70(1) requires a data controller to process and store personal data on a server or data centre located in the Republic. Section 70(2) lets the Minister prescribe categories of personal data that may be stored outside it. Section 70(3) keeps sensitive personal data on a server or data centre in the Republic despite that power.
Section 71(1) lets personal data outside those prescribed categories be transferred abroad where the data subject has consented and either the transfer is made under standard contracts or intra-group schemes the Commissioner has approved or the Minister has prescribed that transfers out are permissible, or where the Commissioner approves a particular transfer or set of transfers as permissible out of necessity.
Section 71(2) lets the Minister prescribe the criteria for those transfers only where the personal data will be subject to an adequate level of protection and enforcement by authorities with appropriate jurisdiction is effective, and section 71(3) has the Commissioner monitor the circumstances of data so transferred.
Section 71(4) permits transfer in an emergency to a person providing health or emergency services, where the data subject has explicitly consented to the transfer of sensitive personal data, and to an international organisation or country the Commissioner is satisfied about.
Section 71(6) requires a controller transferring under a standard contract or intra-group scheme to certify and periodically report to the Commissioner that it does so, and to bear liability for harm caused by the transferee's non-compliance. Section 1 leaves commencement to a statutory instrument appointed by the Minister. The Data Protection Act (Commencement) Order, 2021 brought the Act into operation on , which is the day these provisions began to bind.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .