Zambia’s Data Protection Commissioner Fully Operational, Enforcing Privacy Compliance
Chilufya-Musonda and Mwamulima urge data controllers and processors operating in Zambia to promptly assess their compliance status and align with these requirements to mitigate the risk of potential enforcement actions.
The Office of the Data Protection Commissioner (ODPC) is now fully operational, enforcing privacy and data protection compliance in Zambia.Zambia’s data protection legislation, the Data Protection Act 2021 (DPA), came into force in April 2021. Two years later, in June 2023, the country’s first Data Protection Commissioner was appointed as required by the DPA.
According to Bwalya Chilufya-Musonda, Partner at African law firm Bowmans in Zambia, the DPA, among other things, seeks to establish a robust framework that governs the collection, use, processing, storage, and transmission of personal data, ensuring its protection throughout these processes. It also regulates the activities of data controllers and processors to promote transparency, accountability and security in the handling of personal information.
“The complete operationalisation of the ODPC is a significant milestone in Zambia’s developing privacy and data protection framework. So far, the ODPC has issued essential regulations and guidelines in compliance with the Commissioner’s jurisdiction under the DPA,” she says.
Joshua Mwamulima, Partner at Bowmans Zambia, further notes that the ODPC has also initiated the online registration process for data controllers and processors, requiring all data processors and controllers to register by 30 April 2025.
“Failing to register by the stated date is an offence punishable by a fine of ZMW 200 000 (approximately USD 7 186) and/ or imprisonment of up to five years. We anticipate that enforcement will follow in due course,” Mwamulima explains.
Chilufya-Musonda and Mwamulima urge data controllers and processors operating in Zambia to promptly assess their compliance status and align with these requirements to mitigate the risk of potential enforcement actions.
According to Bwalya Chilufya-Musonda, Partner at African law firm Bowmans in Zambia, the DPA, among other things, seeks to establish a robust framework that governs the collection, use, processing, storage, and transmission of personal data, ensuring its protection throughout these processes. It also regulates the activities of data controllers and processors to promote transparency, accountability and security in the handling of personal information.
“The complete operationalisation of the ODPC is a significant milestone in Zambia’s developing privacy and data protection framework. So far, the ODPC has issued essential regulations and guidelines in compliance with the Commissioner’s jurisdiction under the DPA,” she says.
Joshua Mwamulima, Partner at Bowmans Zambia, further notes that the ODPC has also initiated the online registration process for data controllers and processors, requiring all data processors and controllers to register by 30 April 2025.
“Failing to register by the stated date is an offence punishable by a fine of ZMW 200 000 (approximately USD 7 186) and/ or imprisonment of up to five years. We anticipate that enforcement will follow in due course,” Mwamulima explains.
Chilufya-Musonda and Mwamulima urge data controllers and processors operating in Zambia to promptly assess their compliance status and align with these requirements to mitigate the risk of potential enforcement actions.
