# THE DATA PROTECTION ACT, 2021
Arrangement of Sections
# PART I
# PrELimiNarY PrOvIsions
# Section
1.Short title and commencement 2. Interpretation 3. Application
# PART II
# Office of the Data Protection Commissioner
- Establishment of Office of Data Protection Commissioner
- Data protection Commissioner
- Appointment of Deputy Data Protection Commissioners and other staff
# PART III
# INSPECTORATE
- Inspector
8.Power of inspectors Arrest without warrant 0. Seizure of property Restoration of property
# PART IV
# Principles and Rules Relating to Processing of Personal Data
Principles relating to processing of personal data 13.Processing of personal data 14. Processing of sensitive personal data 15. Consent, justification and objection 16. Collection of personal data 7Processing of child and vulnerable person's personal data 18.Offence and penalty for contravention of personal data obligation
# PART V Regulation of Data Controllers, Data Processors and Data Auditors
- Prohibition from controlling or processing personal data without registration
- Application for registration as data processor or data controller
21.Registration of data controller and data processor Renewal of certificate of registration Change in details of data controller or data processor 24 Suspension and cancellation of registration 25. Re-registration Surrender of certificate of registration 27.Exemption from registration 28. Power to forbear
# PART VI Data Auditors
- Data auditors
- Application for licence
- Issue of licences
- Conditions of licence
- Variation of licence
- Surrender of licence
- Transfer of licence
- Suspension and cancellation
- Renewal of licence
38.Functions of a data auditor
# PART VII Exemption from Principles and Rules of Processing of Data
39National security, defence and public order 40.Prevention, detection investigation and prosecution of contraventions of law 4Processing for purpose of legal proceedings
4Research, archiving or statistical purpose 43. Journalistic purpose Processing to be lawful and legitimate
# PART VIII
# Duties of Data Controller and Data Processor
45.Record of processing activities 46. Data protection impact assessment 4Security of processing 48. Appointment of data protection officer 49.Notification of security breach 50. Accountability 51. Data retention 52.Duties of data processor 53. Non-disclosure of personal data 54.Joint controllers 55.Offence by data controller 5Personal data in legal proceedings 57. Notification
# PART IX
# Rights of the Data Subject
- Right of access and notification
59.Right to rectification 60.Right to erasure 61.Right of objection Decision taken on basis of automatic data processing Right to restriction of processing Information when personal data collected directly from data subject 5Right to data portability 6.Notification obligation Derogation from rights 68. Complaints 69. Appeals
# PART X Transfer of Personal Data Outside the Republic
70.Crossborder transfer of personal data 71Conditions for crossborder transfer of personal data
# PART XI GENERaL PROVIsionS
7Right to compensation 73. Offences 74. Power of Data Protection Commissioner to compound certain offences 75. Forfeiture 76Offence by principal officer, shareholder or partner of body corporate or unincorporate body 77. General penalty 78. Code of conduct 79. Guidelines 80. Register 8.Auditing of data controller 82. Regulations
# GOVERNMENT OF ZAMBIA
# ACT