Zambie - THE DATA PROTECTION ACT, 2021

Arrangement of Sections

PART I

PrELimiNarY PrOvIsions

Section

1. Short title and commencement
2. Interpretation
3. Application

PART II

Office of the Data Protection Commissioner

4. Establishment of Office of Data Protection Commissioner

5. Data protection Commissioner

6. Appointment of Deputy Data Protection Commissioners and other staff

PART III

INSPECTORATE

1. Inspector
2. Power of inspectors

Arrest without warrant 0. Seizure of property Restoration of property

PART IV

Principles and Rules Relating to Processing of Personal Data

Principles relating to processing of personal data 13.Processing of personal data 14. Processing of sensitive personal data 15. Consent, justification and objection 16. Collection of personal data 17. Processing of child and vulnerable person's personal data 18.Offence and penalty for contravention of personal data obligation

PART V Regulation of Data Controllers, Data Processors and Data Auditors

1. Prohibition from controlling or processing personal data without registration
2. Application for registration as data processor or data controller
3. Registration of data controller and data processor

Renewal of certificate of registration Change in details of data controller or data processor 24. Suspension and cancellation of registration 25. Re-registration Surrender of certificate of registration 27. Exemption from registration 28. Power to forbear

PART VI Data Auditors

29. Data auditors

30. Application for licence

31. Issue of licences

32. Conditions of licence

33. Variation of licence

34. Surrender of licence

35. Transfer of licence

36. Suspension and cancellation

37. Renewal of licence

38. Functions of a data auditor

PART VII Exemption from Principles and Rules of Processing of Data

1. National security, defence and public order
2. Prevention, detection investigation and prosecution of contraventions of law
3. Processing for purpose of legal proceedings
4. Research, archiving or statistical purpose
5. Journalistic purpose
6. Processing to be lawful and legitimate

PART VIII

Duties of Data Controller and Data Processor

1. Record of processing activities
2. Data protection impact assessment
3. Security of processing
4. Appointment of data protection officer
5. Notification of security breach
6. Accountability
7. Data retention
8. Duties of data processor
9. Non-disclosure of personal data
10. Joint controllers
11. Offence by data controller
12. Personal data in legal proceedings
13. Notification

PART IX

Rights of the Data Subject

1. Right of access and notification
2. Right to rectification
3. Right to erasure
4. Right of objection

Decision taken on basis of automatic data processing Right to restriction of processing Information when personal data collected directly from data subject 5Right to data portability 6. Notification obligation Derogation from rights 68. Complaints 69. Appeals

PART X Transfer of Personal Data Outside the Republic

1. Crossborder transfer of personal data
2. Conditions for crossborder transfer of personal data

PART XI GENERAL PROVISIONS

71. Right to compensation

72. Offences

73. Power of Data Protection Commissioner to compound certain offences

74. Forfeiture