Zambia Data Protection Act No. 3 of 2021
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | ZM DPA |
| Region | Middle East & Africa |
| Country or scope | Zambia |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers ZM DPA
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ZM-DPA-SEC Security of Personal Data | Controllers and processors must secure personal data with appropriate technical and organisational measures against loss, unauthorised access and alteration, evidenced by integrity hashes on processing-system components (Data Protection Act No. 3 of 2021, security-of-processing obligations) | Scan |
ZM-DPA-REG Registration and Processing Records | Data controllers and processors must register with the Data Protection Commissioner, which presupposes an accurate inventory of the software systems used for processing (Data Protection Act No. 3 of 2021, registration provisions) | Scan |
ZM-DPA-PROC Processor Engagement Controls | Processing on a controller's behalf must occur under contract with sufficient security guarantees, so third-party software components must carry named suppliers (Data Protection Act No. 3 of 2021, controller-processor provisions) | Scan |
ZM-DPA-BRN Breach Notification Readiness | Personal data breaches must be notified to the Commissioner, which requires the components of affected systems to be identifiable so impact can be assessed (Data Protection Act No. 3 of 2021, breach-notification duty) | Scan |
ZM-DPA-DOC Demonstrable Documentation | Accountability to the Commissioner requires software records to be identifiable, timestamped documents whose creator is recorded (Data Protection Act No. 3 of 2021, accountability duties) | Scan |
Policy templates
All 22 from the standard set, adapted to ZM DPA.
Zambia Cyber Security and Cyber Crimes Act 2021
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
Zimbabwe Cyber and Data Protection Act 2021
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.