Esheria Esheria Statutes
Ask AI Sign in

Zambia Statutory instrument

Zambia legislation

Data Protection (Registration and Licensing) Regulations, 2021

These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021. This section defines “micro organisation,” “medium organisation,” “large organisation,” and “licensee” for these…

DPIADPO appointmentaccess requestsappendicesapplication accuracyapplication formsapplication rejection noticeapplication requirementsbackground screeningbusiness cessation noticecertificate registrationcertificate suspensioncessation of businesschange of particularscompany registrationcomplianceconsentcriminal history disclosurecross-border transferdata audit servicesdata auditing servicesdata breachesdata controller registrationdata controllershipdata governancedata processingdata processing compliancedata processor registrationData protectiondata protection impact assessmentdata protection registrationdata servicesdata-digitaldatabase registrationdeclarationsdisclosureerasurefeesform completionidentificationlicence amendmentslicence revocationlicence validityBusiness registrationlicensing administrationlicensing applicationnotificationorganization sizepersonal data processingprivacy noticesprocessing recordspublic inspectionre-registrationrecord keepingrecord retentionrecord-keepingregister maintenanceregistrationregistration and licensingregistration changesregistration feesregistration informationregulatory applicationsregulatory approvalregulatory enforcementregulatory filingregulatory reportingrenewalrenewal applicationsensitive personal dataservice qualityservice quality declarationssuspension or cancellation notice
Jurisdiction
Zambia
Structure
54 provisions
Citation
SI 58 of 2021
Dates
As at 14 May 2021
More statute details
Dates
As at 14 May 2021

Publicly available, excluded from search-engine indexing

This page remains available for direct research for the following reasons:

  • The record does not meet this release's canonical indexing criteria. (market-indexing-disabled)
  • The record does not meet this release's canonical indexing criteria. (emergency-noindex)
On this page

Professional statute overview

Enactment structure, operative effect and source provenance

Official source

01

Purpose and legislative effect

“These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021.”

These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021. This section defines “micro organisation,” “medium organisation,” “large organisation,” and “licensee” for these Regulations. The Data Protection Commissioner must register data controllers and data processors in specified categories and charge different fees for each category. A person intending to act as a data controller or data processor must apply to the Data Protection Commissioner for a certificate of registration in Form I. The Data Protection Commissioner may ask an applicant for more particulars about an application, and the applicant must submit them in Form II within the specified period.

02

How the instrument operates

  1. 01

    Start with the recorded version

    As at 14 May 2021. The date shown identifies this source expression and should not be treated as proof that no later change exists.

  2. 02

    Locate the controlling provision

    Use the provision map, part headings and full-text filter to move from the broad subject to the exact legal language.

  3. 03

    Read conditions and exceptions together

    Keep subsections, definitions, provisos and cross-references in context before drawing a legal conclusion.

  4. 04

    Verify currency and official wording

    Confirm later legislation, commencement notices and corrections with the official publisher before advice, filing or reliance.

03

Research entry points

Selected provisions across the instrument. Open any row to continue with the exact stored text.

Section 11

The form asks whether the applicant has ever been convicted of fraud, dishonesty, or certain offences under specified Zambian laws, and asks for details if the answer is yes.

Section 11

Name of assignee

The section lists assignee details to be provided: name, nationality, and NRC or passport number, with certified copies attached.

Section 4

Section 2

A data controller must appoint a Data Protection Officer and carry out a Data Protection Impact Assessment.

Section 2

04

Source and current-law status

Source record view

Source record from zambialii.org · As at 14 May 2021

Verify current force

The source record does not state a definitive current-law status. Check the official publisher and later amendments before relying on this text.

For advice, pleadings, or compliance decisions, retain the official source and confirm the current consolidated provision.

Official record

Source-indexed provision map

Sections and provisions

Search by section, heading, part or exact legal wording. Every result remains linked to the stored source record.

Showing 54 of 54 provisions

Provision 45Amendment 4Commencement 2Offence 2
§ 1These Regulations may be cited as the Data ProtectionProvision

These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021.

1. These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021.
Section 1Verify source
§ 2Section 2Interpretation

This section defines “micro organisation,” “medium organisation,” “large organisation,” and “licensee” for these Regulations.

2. In these Regulations, unless the context otherwise requires “ micro organisation ” means an entity with a maximum Interpretation of ten employees; “ medium organisation ” means an entitywith more than ten employees but not more than fifty employees; “ large organisation ” means an entitywith more than fifty employees; and “ licensee ” means a person lincensed to offer data auditing services under regulation 14.
Section 2Verify source
§ 3(1) The Data Protection Commissioner shall register aProvision

The Data Protection Commissioner must register data controllers and data processors in specified categories and charge different fees for each category.

3. (1) The Data Protection Commissioner shall register a data controller and a data processor in the following category: (a) micro organisation; (b) medium organisation; (c) (d) a large organisation;and an individual. Categories of data controllers and data processors Copies of this Statutory Instrument can be obtained from the Government Printer, P.O. Box 30136, 10101, Lusaka, Price K60.00 each 484 Statutory Instruments 14th May, 2021 Application for certificate o f registration Request for further particulars Issue of certificate o f registration Duration of certificate of registration Rejection of application Renewal of certificate of registration Notice of change of particulars Notice of surrender of certificate o f registration Suspension or cancellation o f certificate of registration (2) The Data Protection Commissioner shall charge different fees for each category as set out in the Second Schedule.
Section 3Verify source
§ 4A person who intends to operate as a data controller orProvision

A person intending to act as a data controller or data processor must apply to the Data Protection Commissioner for a certificate of registration in Form I.

4. A person who intends to operate as a data controller or data processor shall apply to the Data Protection Commissioner for a certificate of registration in Form I set out in the First Schedule.
Section 4Verify source

Part

Schedule.

§ 5The Data Protection Commissioner may, where the DataProvision

The Data Protection Commissioner may ask an applicant for more particulars about an application, and the applicant must submit them in Form II within the specified period.

5. The Data Protection Commissioner may, where the Data Protection Commissioner requires further particulars in relation to an application, request an applicant to submit further particulars, within a specified period, in Form II set out in the First Schedule.
Section 5Verify source
§ 6The Data Protection Commissioner shall, where theProvision

The Data Protection Commissioner must issue a certificate of registration in Form III if the applicant meets the Act’s requirements.

6. The Data Protection Commissioner shall, where the applicant meets the requirements of theAct, issue a certificate of registration in Form III set out in the First Schedule.
Section 6Verify source
§ 7The certificate of registration issued under theseProvision

A certificate of registration issued under these Regulations is valid for one year.

7. The certificate of registration issued under these Regulations is valid for a period of one year.
Section 7Verify source
§ 8The Data Protection Commissioner shall, where the DataProvision

If the Data Protection Commissioner rejects an application, the Commissioner must inform the applicant within 14 days.

8. The Data Protection Commissioner shall, where the Data Protection Commissioner rejects an application, inform the applicant within fourteen days from the date of the decision of the rejection in Form IV set out in the First Schedule.
Section 8Verify source
§ 9A holder of a certificate of registration shall apply forProvision

A holder of a certificate of registration must apply to renew it using Form V in the First Schedule.

9. A holder of a certificate of registration shall apply for renewal of a certification of registration in Form V set out in the First Schedule.
Section 9Verify source
§ 10A holder of a certificate of registration shall notify theProvision

A holder of a certificate of registration must notify the Data Protection Commissioner of any change in registration particulars using Form VI in the First Schedule.

10. A holder of a certificate of registration shall notify the Data Protection Commissionerof anychangein particulars relating to registration in Form VI set out in the First Schedule.
Section 10Verify source
§ 11The data controller or data processor shall notify theProvision

A data controller or data processor must notify the Data Protection Commissioner when it stops carrying on business in the data processing or controlling industry.

11. The data controller or data processor shall notify the Data Protection Commissioner, where a data controller or data processor ceases to carry on business in the data processing or controlling industry, in Form VII set out in the First Schedule.
Section 11Verify source
§ 12(1) The Data Protection Commissioner shall, before theProvision

The Data Protection Commissioner must notify the certificate holder before suspending or cancelling the certificate, and the holder must respond with cause or remedial measures within the notice period.

12. (1) The Data Protection Commissioner shall, before the Data Protection Commissioner suspends or cancels a certificate of registration, notifythe holder of the certificate of registration of the intention to suspend or cancel the certificate of registration in Form VIII set out in the First Schedule. (2) Wherethe holderof thecertificateofregistration is notified of the intention of the Data Protection Commissioner under subregulation, (1) theholder of the certificateof registration shall— 14th May, 2021 Statutory Instruments 485 (i) (ii) show cause whythe certificate of registration should not be suspended or cancelled; or take remedial measures to the satisfaction of the Data Protection Commissioner within the times specified in notice. (3) The Data Protection Commissioner shall, where the holder fails to show cause why the certificate should not be cancelled or suspended or fails to take remedial measures to the satisfaction of the Data Protection Commissioner, cancel or suspend the certificate of registration. (4) Where the Data Protection Commissioner suspends or cancels a certificate of registration under subregulation (3), the Data Protection Commissioner shall, inform the holder of a certificate of registration of the suspension or cancellation of the certificate in Form IX set out in the First Schedule.
Section 12Verify source
§ 13A person whose certificate of registration issued underProvision

If a person’s registration certificate has been cancelled, they may apply to re-register as a data processor or data controller using Form V.

13. A person whose certificate of registration issued under these Regulations has been cancelled, may apply for re registration as a data processor or data controller in Form V set out in the First Schedule. PART II DATA AUDITOR Application for re- registration
Section 13Verify source

Part

PART II

§ 14(1) A person who intends to provide data audit servicesProvision

A person intending to provide data audit services must apply to the Data Protection Commissioner for a licence in Form I.

14. (1) A person who intends to provide data audit services shall apply to the Data Protection Commissioner for a licence in Form I set out in the First Schedule . (2) A Data Protection Commissioner shall, where the Application for licence applicant— (a) meets the requirements of theAct, issue the applicant with a licence in Form X set out in the First Schedule; or (b) does not meet the requirements of theAct, reject the application and inform the applicant of the rejection in Form IV set out in the First Schedule stating the reasons for the rejection.
Section 14Verify source
§ 15The licence issued under these Regulations is valid for aAmendment

The licence issued under these Regulations is valid for two years.

15. The licence issued under these Regulations is valid for a period of two years. Duration of licence 486 Renewal of licence Transfer of licence Amendment of licence Notice to surrender licence Suspension or cancellation of licence Statutory Instruments 14th May, 2021
Section 15Verify source
§ 16A licensee who intends to renew that licencee’s shall,Provision

A licensee who wants to renew a licence must apply to the Data Protection Commissioner at least three months before the licence expires, using Form V.

16. A licensee who intends to renew that licencee’s shall, apply to the Data Protection Commissioner, for renewal of a licence at least three months before the expiry of the licence, in Form V set out in the First Schedule.
Section 16Verify source
§ 17An application to transfer or assign a licence shall beProvision

An application to transfer or assign a licence must be made to the Data Protection Commissioner in Form XI.

17. An application to transfer or assign a licence shall be made to the Data Protection Commissioner, in Form XI set out in the First Schedule.
Section 17Verify source
§ 18A licensee may within the validity of the licence, applyAmendment
18. A licensee may within the validity of the licence, apply to the Data Protection Commissioner for an amendment or variation of the terms and conditions of the licence in Form XII set out in the First Schedule.
Section 18Verify source
§ 19Alicenseeshall, notifythe DataProtection Commissioner,Provision

A licensee must notify the DataProtection Commissioner in Form VII within one month after it stops providing the licensed services and ceases business.

19. Alicenseeshall, notifythe DataProtection Commissioner, where a licensee ceases to provide the services relating to the licence, within one month of ceasing to carry on business, in Form VII set out in the First Schedule.
Section 19Verify source
§ 20(1) The Data Protection Commissioner shall, before theProvision

Before suspending or cancelling a licence, the Data Protection Commissioner must notify the licence holder; if the licensee does not show cause or take satisfactory remedial measures within the specified time, the Commissioner must suspend or cancel the licence and inform the licensee.

20. (1) The Data Protection Commissioner shall, before the Data Protection Commissioner suspends or cancels a licence, notify the holder of the licence of the Data Protection Commissioner’s intention to suspend or cancel the licence in Form VIII set out in the First Schedule. (2) The Data Protection Commissioner shall suspend or cancel the licence and inform the licensee in Form IX set out in the First Schedule where a licensee who is notified of the intention to suspend or cancel a licence under sub-regulation (1)— (i) (ii) fails to show cause why the licence should not be cancelled or suspended; or does not take any remedial measures to the satisfaction of DataProtection Commissioner within the specified time. PART III GENERAL PROVISIONS Record of processing activities Data protection impact assessment
Section 20Verify source

Part

PART III

§ 21A data controller or data processor shall keep andProvision

A data controller or data processor must keep and maintain a record of processing activities and meta data in Form XIII in the First Schedule.

21. A data controller or data processor shall keep and maintain a record of processing activities and meta data in Form XIII set out in the First Schedule.
Section 21Verify source
§ 22The data protection impact assessment shall be made inProvision

A data protection impact assessment must be made using Form XIV in the First Schedule.

22. The data protection impact assessment shall be made in Form XIV set out in the First Schedule. 14th May, 2021 Statutory Instruments 487
Section 22Verify source
§ 23The Data Protection Commissioner shall keep andProvision

The Data Protection Commissioner must keep and maintain a register, and the public may inspect it during normal working hours on payment of the fee in the Second Schedule.

23. The Data Protection Commissioner shall keep and maintain aregister, which shall be open to inspection bythe public during normal working hours on payment of a fee set out in the Second schedule.
Section 23Verify source
§ 24The fees set out in the Second Schedule are fees payableProvision

Fees listed in the Second Schedule must be paid for the matters named in that Schedule.

24 . The fees set out in the Second Schedule are fees payable Fees for the matters specified in that Schedule. 488 Statutory Instruments 14th May, 2021 FIRST SCHEDULE (Regulations4, 5,6,8,9,10,11,12,13,14,16, 17, 18, 19, 20, 21 and 22) Form I (Regulations 4 and 14) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 APPLICATION FOR REGISTRATION/LICENCE Shaded Fields for official use only Certificate/License code Date and Time InformationRequired InformationProvided
Section 24Verify source
§ 7Section 7Provision

This section is an application form for data service-related documents and asks applicants to provide identification and contact details.

7. Type of Document ☐Licence(Data Auditor)☐Certificate (Data Controller and Data Processor) Type of Data Service Data Service Category (Data Auditor Only) Name(s) of applicant(s) (a) Nationality of applicant(s) (b) Identity card of applicant(s) – Attach certified copies ☐ Data Processor ☐ Data Controller ☐Data Auditor ☐ Data Auditor - Public Critical Information Infrastructure☐Data Auditor - Private Public Critical Information Infrastructure☐Data Auditor- General NRC No. Passport No. Type of applicant ☐ Individual ☐ Company ☐ Partnership (a) Notification Address Tell: Email: (b) Information of contact person authorised to represent the applicant Tell: Email: 14th May, 2021 Statutory Instruments 489
Section 7Verify source
§ 8Where the applicant is a company, the following details are requiredProvision

If the applicant is a company, it must provide the company name, company address, and company registration number.

8. Where the applicant is a company, the following details are required: (a) company name: (b) company address: (c) company registration No.:
Section 8Verify source
§ 9Section 9Provision

This item asks whether the person has ever applied to provide data auditing, data controller, or data processor services in Zambia, and to give details if yes.

9. Have you ever applied to provide data auditing, data controller or data processor services in Zambia? If yes please give details: (a) Service applied for Location Brief description of service Date of application Status of application (Granted, rejected or pending) (b)
Section 9Verify source
§ 11Section 11Commencement

The form asks whether the applicant has ever been convicted of fraud, dishonesty, or certain offences under specified Zambian laws, and asks for details if the answer is yes.

11. If application was rejected, give reasons for rejection: Service commencement details Proposed commencement date: (b) Brief description Have you been convicted of an offence involving fraud or dishonesty or of any offence under the Data Protection Act 2021, Electronic Communication and Transaction Act, 2021 or any of their predecessors, Or any other law within Zambia? If yes, specify details: ……………………………………………………………………………………………………………………………… Nature of offence: …………………………………………………………………………………………………………………………………… Date of Conviction: …………………………………………………………………………………………………………………………………… Sentence: …………………………………………………………………………………………………………………………………………………
Section 11Verify source
§ 12Where the applicant is a controller, the following database registration details are required: (To be filled by a Data Controller ONLY)Provision

If the applicant is a controller, the data controller must provide database registration details.

12. Where the applicant is a controller, the following database registration details are required: (To be filled by a Data Controller ONLY) (a) Name of database(s): (b) A description of the information to be stored: (c)What is the information used for? (d)Will/Is the information be passed or shared with other organisation(s)/persons? If ‘Yes’ who and why? (e)Is/Will the information be transferred outside Zambia? If ‘Yes’, where? And why? (f)Detail how the information will/is kept safe and secure.
Section 12Verify source
§ 13AppendicesProvision

This section says the appendices apply only to data controllers and data processors, and the Authority may require other relevant information.

13. Appendices Appendix No. 1 Database Registration Details Applicability Applicable to Data Controller and Data Processor ONLY Appendix No. 2 Such other relevant information as the Authority may require
Section 13Verify source
§ 14Section 14Provision

The applicant declares that service quality will meet required minimum standards and that application information is true and complete; if information is false or fraudulent, the licence may be revoked.

14. QUALITY OF SERVICE UNDERTAKING I/we declare that the quality of service I/we provide shall meet the minimum requirements set out under the Act or any other law or, guidelines published by the Data Protection Commissioner or any international standard. 490 Statutory Instruments 14th May, 2021 DECLARATION I/we declare that all the particulars and information provided in this application are complete, correct and true and I/we agree that in the event that any of the said particulars and information provided is found to be untrue or fraudulent, the licence will be revoked.
Section 14Verify source
§ 15Section 15Provision

If the business changes or stops operating under the registration, the applicant must notify the Authority; the registration may then be revoked or revised. If the licence is revoked, any fee paid for the licence is forfeited.

15. I/we agree that in the event of the revocation of the licence, any fee paid to the authority for licence shall be forfeited. I/we declare that in the event that the nature of my/our business changes, or I/we no longer carry out operations in terms of the registration, I/we will notify the Authority in which case my/our registration may be revoked or revised. Declared at ………………………… this ……… days of ………… 20……… by the following persons who are duly authorised to sign for and on behalf of the applicant under the authority of the Power of Attorney or Board resolution which is hereby attached. My Details – Attachments ______________________________ Applicant ___________________________ Officer FOR OFFICIAL USE ONLY _________________________________ Date _________________________________ Date Received by ______________________________________ Officer Date Received____________________________ Amount Received: __________________________________ Serial No. of application: ____________________________ 14th May, 2021 Statutory Instruments 491 Form II (Regulation 5) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 REQUEST FOR FURTHER PARTICULARS To: [Insert Applicant/ Certificate Holder Name]....................................................... In relation to your application for a(n) [Insert Certificate Category Number]...........address of [Insert Applicant/ Certificate Holder’s Current Address]. ]with reference number [Insert Reference [Insert details of further particulars being requested] The failure to submit treated as invalid and shall be rejected. the requested information within [Insert Period] from the date hereof shall lead to your application being Dated this [Insert day] day of [Insert Month] [Insert Year] ……………………………………….. Data Protection Commissioner 492 Statutory Instruments 14th May, 2021 Form III (Regulation 6) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 Certificate No.: ………… In accordance with Section 21 of the Data Protection Act No. 3 of 2021, this INSERT CERTIFICATE TYPE _ is granted by the Data Protection Commissionerto- is granted by the Data Protection Commissioner to INSERT HOLDER NAME INSERT HOLDER ADDRESS for establishment and operation of a INSERT STATION/SYSTEM TYPE for the purpose of carrying on INSERT SERVICE as specified in the Terms and Conditions as shown in the Annexures attached hereto. Date of Issue: …….…...………………… Date of Expiry: …………………………. Initial Fee: ………………………………….. Annual Renewal Fee: ……..………………... ………………………………………………… Data Protection Commissioner 14th May, 2021 Statutory Instruments 493 Form IV (Regulations 8 and 16) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTICE OF REJECTION To [Insert Applicant Name] Applicant Address] Reference Number] your application has been rejected on the following grounds: of[Insert . IN THE MATTER OF [Insert you are hereby notified that The grounds for rejection of the application are shown in the Annexures attached hereto. Dated this [Insert day] day of [Insert Month] [Insert Year] ……………………………………….. Data Protection Commissioner 494 Statutory Instruments 14th May, 2021 Form V (Regulations 9, 13 and 16) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Licensing) Regulations, 2021 APPLICATION FOR REGISTRATION, RENEWAL FOR REGISTRATION/LICENCE Information Required Information Provided Shaded Fields for official use only Certificate/License code Date and Time
Section 15Verify source
§ 6Section 6Provision

This section is a form asking for renewal or reregistration details and applicant information for data controller or data processor services.

6. Reason for Renewal ☐Renewal☐Reregistration (Data Controller and Data ProcessorONLY) Type of Data Service ☐ Data Processor ☐ Data Controller☐Data Auditor NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership Name(s) of applicant(s) (a) Nationality of applicant(s) (b) Identity card of applicant(s) – Attach certified copies Type of applicant (a) Notification Address Tell: Email: (b) Information of contact person authorised to represent the applicant Tell: Email:
Section 6Verify source
§ 7Section 7Provision

If the applicant is a company, it must provide the company name, company address, and company registration number.

7. Where the applicant is a company, the following details are required: (a) company name: (b) company address: (c) company registration No.:
Section 7Verify source
§ 8Section 8Provision

This section asks whether you have ever applied to provide data auditing, data controller, or data processor services in Zambia, and if so to give details.

8. Have you ever applied to provide data auditing, data controller or data processor services in Zambia? If yes please give details: (a) Service applied for Location Brief description of service Date of application Status of application (Granted, rejected or pending) 14th May, 2021 Statutory Instruments 495 pending) (b) (b) If application was rejected, give reasons for rejection:
Section 8Verify source
§ 10Section 10Commencement

The form asks whether the respondent has been convicted of certain offences and, if yes, to provide details.

10. Service commencement details Proposed commencement date: (b) Brief description Have you been convicted of an offence involving fraud or dishonesty or of any offence under the Data Protection Act 2021, Electronic Communication and Transaction Act, 2021 or any of their predecessors, Or any other law within Zambia? If yes, specify details: ……………………………………………………………………………………………………………………………… Nature of offence:
Section 10Verify source
§ 11Section 11Provision

This section is a form line for recording the date of conviction and the sentence.

11. …………………………………………………………………………………………………………………………………… Date of Conviction: …………………………………………………………………………………………………………………………………… Sentence: …………………………………………………………………………………………………………………………………………………
Section 11Verify source
§ 12AppendicesProvision

This section lists appendices for database registration information and says they apply only to data controllers and data processors.

12. Appendices Appendix No. 1 Database Registration Information Applicability Applicable to Data Controller and Data Processor ONLY Appendix No. 2 Such other relevant information as the Authority may require
Section 12Verify source
§ 13Section 13Provision

The applicant declares that the service will meet required standards and that the application information is true, complete, and correct.

13. QUALITY OF SERVICE UNDERTAKING I/we declare that the quality of service I/we provide shall meet the minimum requirements set out under the Act or any other law or, guidelines published by the Data Protection Commissioner or any international standard. DECLARATION I/we declare that all the particulars and information provided in this application are complete, correct and true and I/we agree that in the event that any of the said particulars and information provided is found to be untrue or fraudulent, the licence will be revoked.
Section 13Verify source
§ 14Section 14Provision

If the business changes or stops operating under the registration, the applicant must notify the Data Protection Commissioner; if the licence is revoked, any fee paid to the authority is forfeited.

14. I/we agree that in the event of the revocation of the licence, any fee paid to the authority for licence shall be forfeited. I/we declare that in the event that the nature of my/our business changes, or I/we no longer carry out operations in terms of the registration, I/we will notify the Data Protection Commissioner in which case my/our registration may be revoked or revised. Declared at ………………………… this ……… days of ………… 20……… by the following persons who are duly authorised to sign for and on behalf of the applicant under the authority of the Power of Attorney or Board resolution which is hereby attached. My Details – Attachments ___________________________ Applicant ___________________________ Officer FOR OFFICIAL USE ONLY _________________________________ Date _________________________________ Date Received by ______________________________________ Date Received____________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 496 Statutory Instruments 14th May, 2021 Form VI (Regulation10) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 CHANGE OF PARTICULARS Shaded Fields for official use only Certificate/Licence code Date and Time Information Required Information Provided Type of Data Service ☐ Data Processor ☐ Data Controller ☐Data Auditor
Section 14Verify source
§ 4Name of assigneeProvision

The section lists assignee details to be provided: name, nationality, and NRC or passport number, with certified copies attached.

4. Name of assignee Nationality Identity card (NRC) No. or Passport No.- (attach certified copies)
Section 4Verify source
§ 6Section 6Provision

This section is titled “Reasons for changes” and lists items (a) to (f).

6. Reasons for changes (a) (b) (c) (d) (e) (f)
Section 6Verify source
§ 7AppendixProvision

This is a form for giving notice of an intention to surrender a licence or certificate of registration.

7. Appendix Appendix No. 1 Appendix No. 2 My Details – Attachments Reasons for change of details Such other relevant information as the Authority may require ___________________________ Applicant _________________________________ Date ___________________________ Officer _________________________________ Date 14th May, 2021 Statutory Instruments 497 FOR OFFICIAL USE ONLY Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 498 Statutory Instruments 14th May, 2021 Form VII (Regulations (11 and 19) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTICE OF INTENTION TO SURRENDER LICENCE/CERTIFICATE OF REGISTRATION Information Required Information Provided Shaded Fields for official use only Certificate code Date and Time Type of Data Service ☐ Data Auditor☐ Data Controller☐ Data Processor
Section 7Verify source
§ 2Section 2Provision

This text appears to be a label for a certificate or licence number and the current holder.

2. Certificate/Licence No. Current Holder
Section 2Verify source
§ 3Name(s) of assignee(s)Provision

This section lists the information required about the assignee(s): name(s), nationality, details, type, and address.

3. Name(s) of assignee(s) Nationality of assignee(s) Details of assignee Type of assignee Assignee’s Address
Section 3Verify source
§ 6AppendicesProvision

This section contains appendices and form templates for registration, suspension/cancellation notices, licences, and transfer applications.

6. Appendices Appendix No. 1 Appendix No. 2 My Details - Attachments NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership (a) (b) (c) (d) (e) Reasons for surrender Such other relevant information as the Authority may require ___________________________ Holder of certificate of Registration _________________________________ Date ___________________________ Officer _________________________________ Date 14th May, 2021 Statutory Instruments 499 FOR OFFICIAL USE ONLY Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 500 Statutory Instruments 14th May, 2021 Form VIII (Regulation 12 (1) and 20(1)) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTICE OF INTENTION TO SUSPEND OR CANCEL CERTIFICATE OF REGISTRATION To [Insert Applicant/ Certificate Holder Name] In the matter of [Insert Certificate Category ]with reference number [Insert Reference Number] address of [Insert Applicant/ Certificate Holder’s Current Address].You are hearby notified that the Authority intends to *suspend/cancel* your certificate on the following grounds: (a)................................................................................................................................. (b)................................................................................................................................. (c)................................................................................................................................. (d)................................................................................................................................. You are requested to appear before me on the ...........day of...............20............ at the Ministry of Transport and Communications, Lusaka, to show cause why your certificate should not be rejected/take remedial measure to address the concerns raised in paragraphs......to.......above before the ..................day of..............20............... If you fail to *appear before me/take the neccessary remedial measures* before the stipulated date, your certificate will be suspended and subsequently revoked. Accordingly, you are requested to take action to remedy the breaches set out in paragraphs.............(above) within [Insert Number of Days] days of recieving this notice. Failure to remedy the said breaches shall result in the *suspension/cancellation* of your certificate. Dated this Year]……………………………………….. [Insert day] day of [Insert Month] [Insert Data Protection Commissioner *Delete as appropriate 14th May, 2021 Statutory Instruments 501 Form IX (Regulation 12 (4) and 20 (2)) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTIFICATION OF SUSPENSION OR REVOCATION OF CERTIFICATE OF REGISTRATION To [Insert Applicant/ Certificate Holder Name] In the matter of [Insert Certificate Category [Insert Applicant/ Certificate Holder’s Current Address].You are hearby notified that your certificate of registration has been *suspended/revoked* on the following grounds: ]with reference number [Insert Reference Number] address of (a)..................................................................................................................................................................................... (b)..................................................................................................................................................................................... (c)..................................................................................................................................................................................... (d)..................................................................................................................................................................................... Dated this [Insert day] day of [Insert Month] [Insert Year] ……………………………………….. Data Protection Commissioner *Delete as appropriate 502 Statutory Instruments 14th May, 2021 Form X (Regulation 14 (2)) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 In accordance with Section 31 of the Data Protection Act No. 3 of 2021, this Licence No.: ………… INSERT LICENCE TYPE is granted by the Data Protection Commissionerto - INSERT NAME OF LICENCEE INSERT LICENCEE ADDRESS for establishment and operation of a INSERT STATION/SYSTEM TYPE for the purpose of carrying on INSERT SERVICE as specified in the Terms and Conditions as shown in the Annexures attached hereto. Date of Issue: …….…...………………… Date of Expiry: …………………………. Initial Fee: ………………………………….. Annual Renewal Fee: ……..………………... ………………………………………………… Data Protection Commissioner 14th May, 2021 Statutory Instruments 503 Form XI (Regulation 18) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 APPLICATION FOR TRANSFER Shaded Fields for official use only Licence code Date and Time Information Required Information Provided
Section 6Verify source
§ 3Name(s) of assignee(s)Provision

This section lists the information to be provided about assignees: name, nationality, details, type, and address.

3. Name(s) of assignee(s) Nationality of assignee Details of assignee Type of assignee Assignee’s Address
Section 3Verify source
§ 5AppendicesAmendment

This section is an appendix/form page listing attachments and application details for an amendment form.

5. Appendices Appendix No. 1 Appendix No. 2 My Details – Attachments NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership Reasons for transferring Such other relevant information as the Authority may require ___________________________ Applicant _________________________________ Date _________________________________ Date ___________________________ Officer FOR OFFICIAL USE ONLY Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 504 Statutory Instruments 14th May, 2021 Form XII (Regulation 18) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 APPLICATION FOR AMENDMENT Shaded Fields for official use only Certificate code Date and Time Information Required Information Provided Type of Data Service ☐ Data Controller ☐ Data Processor
Section 5Verify source
§ 6AppendicesAmendment

This appendix is a form for a data controller to complete with controller details and record-of-processing information.

6. Appendices Appendix No. 1 Appendix No. 2 My Details – Attachments ___________________________ Applicant ___________________________ Officer FOR OFFICIAL USE ONLY NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership (a) (b) (c) (d) (e) Reasons for amendment Such other relevant information as the Authority may require _________________________________ Date _________________________________ Date Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 14th May, 2021 Statutory Instruments 505 Form XIII (Regulation 21) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 PART 1- DATA CONTROLLER (To be filled by a Data Controller ONLY) RECORD OF PROCESSING ACTIVITIES Section 1: Controller Details Name and contact details Data Protection Officer (if applicable) Representative (if applicable) Name: Address: Email: Telephone: Name: Address: Email Telephone: Name: Address: Email: Telephone: No.
Section 6Verify source

Part

PART 1- DATA CONTROLLER (To be filled by a Data Controller ONLY)

§ 29Provision

This section lists the information fields for a record of processing activities.

2.9. Section 2: Record of Processing Activities Business function Purpose of processing Name and contact details of joint controller (if applicable) Categories of data subjects Categories of personal data Categories of recipients Link to contract with processor Names of other countries or international organisations that personal data are transferred to (if applicable) Safeguards for exceptional transfers of personal data to other countries or international organisations (if applicable) 506 Statutory Instruments 14th May, 2021
Section 2Verify source
§ 82Offence

This provision lists data protection topics and headings, including privacy notices, consent, access requests, data breaches, and sensitive personal data or offence data.

8.2. Retention schedule (if possible) General description of technical and organisational security measures (if possible) Section 3: Privacy Notices Lawful basis for processing personal data Condition for processing sensitive personal data Legitimate interests for the processing (if applicable) Link to record of legitimate interests assessment (if applicable) Rights available to data subjects Existence of automated decision-making, including profiling (if applicable) The source of the personal data (if applicable) Section 4: Consent Link to record of consent Section 5: Access Requests Location of personal data Section 6: Data Protection Impact Assessments Data Protection Impact Assessment required? Data Protection Impact Assessment progress Link to Data Protection Impact Assessment Section 7: Personal Data Breaches Has a personal data breach occurred? Link to record of personal data breach Section 8: Sensitive Personal Data or Criminal Conviction and Offence data Condition for processing Lawful basis for processing 14th May, 2021 Statutory Instruments 507
Section 8Verify source
§ 85Provision

The form asks whether personal data is retained and erased in line with the policy document.

8.5. Link to retention and erasure policy document Is personal data retained and erased in accordance with the policy document? Reasons for not adhering to policy document (if applicable) PART 2- DATA PROCESSOR (To be filled by a Data Processor ONLY) Section 1: Processor Details Name and contact details Data Protection Officer (if applicable) Representative (if applicable) Name: Address: Email: Telephone: No.
Section 8Verify source

Part

PART 2- DATA PROCESSOR (To be filled by a Data Processor ONLY)

§ 27Provision

This form section asks for record-of-processing information, including controller contact details, cross-border data transfers, safeguards for exceptional transfers, and security measures.

2.7. Name: Address: Email Telephone: Name: Address: Email: Telephone: Section 2: Record of Processing Activities Link to contract with controller (If applicable) Name and contact details of controller Name and contact details of controller’s representative (If applicable) Categories of processing Names of other countries or international organisations that personal data are transferred to (If applicable) Safeguards for exceptional transfers of personal data to other countries or international organisations (if applicable) General description of technical and organisational security measures (if possible) 508 Statutory Instruments 14th May, 2021 Form XIV (Regulation 22) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 Notes for Applicants
Section 2Verify source
§ 2Section 2Offence

A data controller must appoint a Data Protection Officer and carry out a Data Protection Impact Assessment.

2. In line with Section 48 of the Data Protection Act 2021, a data controller shall appoint a Data Protection Officer (DPO). In line with Section 46 of the Data Protection Act 2021, a data controller shall carry out a Data Protection Impact Assessment (DPIA) DATA PROTECTION IMPACT ASSESSMENT Section 1: Controller Details Name of controller Subject/title of DPO Name of controller contact /DPO (delete as appropriate) Section 2: Data Protection Impact Assessment Step 1: Identify the need for a DPIA Explain broadly what you aims to achieve with the personal data (PD) and what type of processing it involves. You may find it helpful to refer or link to other documents. Summarise why you identified the need for a DPIA. Step 2: Describe the processing Describe the nature of the processing: How will you collect, use, store and delete data? What is the source of the data? Will you be sharing data with anyone? You might find it useful to refer to a flow diagram or other way of describing data flows. What types of processing identified as likely high risk are involved? 14th May, 2021 Statutory Instruments 509 Describe the scope of the processing: What is the nature of the data, and does it include special category or criminal offence data? How much data will you be collecting and using? How often? How long will you keep it? How many individuals are affected? What geographical area does it cover? Describe the context of the processing: what is the nature of your relationship with the individuals? How much control will they have? Would they expect you to use their data in this way? Do they include children or other vulnerable groups? Are there prior concerns over this type of processing or security flaws? Is it novel in any way? What is the current state of technology in this area? Are there any current issues of public concern that you should factor in? Are you signed up to any approved code of conduct or certification scheme (once any have been approved)? Describe the purposes of the processing: What do you want to achieve? What is the intended effect on data subjects? What are the benefits of the processing – for you, and more broadly? Step 3: Consultation process Consider how to consult with relevant stakeholders: Describe when and how you will seek individuals’ views – or justify why it’s not appropriate to do so. 510 Statutory Instruments 14th May, 2021 Who else do you need to involve within your organisation? Do you need to ask your processors to assist? Do you plan to consult information security experts, or any other experts? Step 4: Assess necessity and proportionality Describe compliance and proportionality measures, in particular: What is your lawful basis for processing? Does the processing actually achieve your purpose? Is there another way to achieve the same outcome? How will you prevent function creep? How will you ensure data quality and data minimisation? What information will you give individuals? How will you help to support their rights? What measures do you take to ensure processors comply? How do you safeguard any international transfers? Step 5: Identify and Assess Risks Identify additional measures you could take to reduce or eliminate risks identified as medium or high risk in step 5 Risk Options to reduce or eliminate risk Effect on risk (Eliminated, Reduced or Accepted) Residual risk (Low, Medium or High) Measure approved (Yes/No) Step 6: Identify measures to reduce risk Identify additional measures you could take to reduce or eliminate risks identified as medium or high risk in step 5 Risk Options to reduce or eliminate risk Effect on risk (Eliminated, Reduced or Accepted) Residual risk(Low, Medium or High) Measure approved(Yes/No) Step 7: Sign off and record outcomes 14th May, 2021 Statutory Instruments 511 Item Name/Position/date Notes Measures approved by: Residual risks approved by: DPO advice provided: Summary of DPO advice: DPO advice accepted or overruled by: Comments: Consultation responses reviewed by: Comments: Integrate actions back into project plan, with date and responsibility for completion If accepting any residual high risk, consult the Data Protection Commissioner before going ahead DPO should advise on compliance, step 6 measures and whether processing can proceed If overruled, you must explain your reasons If your decision departs from individuals’ views, you must explain your reasons This DPIA will be kept under review by: The DPO should also review ongoing compliance with DPIA 512 Statutory Instruments 14th May, 2021 SEOND SCHEDULE (Regulations 3, 23 and 24) PRESCRIBED FEES Category Application Micro Organisation Medium Organisation Large Organisation Data processor 167 333 1000 1000 Certificate of Registration 1,667 3,334 10,000 10,000 Category Application Licence Data auditor-public critical information 3333 entity 1667 individual Data auditor-private critical information Entity/Individual 3333 10,000 entity 16,667individual 33333 entity 16,667 individual Data auditor-general 3333 entity 1667 individual 33333 entity 16667 individual Register Inspection Fee 333 LUSAKA 11th May, 2021 [ MTC.64/9/35 ] M. L. KAFWAYA, Minister of Transport and Communications
Section 2Verify source

Legislative relationships

2 referenced instruments

Names are derived from the stored provision headings and citation-enrichment layer. Treat this as a research index and verify each relationship against the source text.

A–F

1 instrument

  • Data Protection Act

    Sections 2, 6, 15

N–S

1 instrument

  • Processing Act

    Section 2

Recorded versions and source checkpoint

1 version available in this collection

Current-law checkpoint
  • 14 May 2021 · currentEnglish

This relationship view does not by itself establish whether another instrument remains in force.

Check official source

Source-linked research

Ask AI about this statute

The overview, provisions, and source records above are public. Continue in a separate conversation with this statute’s jurisdiction and source version attached.

About this LexChat collection

Statute information is organised from identified legislative sources for professional research. Corrections can be reported to hello@esheria.ai.