Data Protection (Registration and Licensing) Regulations, 2021
These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021.
- Jurisdiction
- Zambia
- Instrument
- Statutory instrument
- Citation
- SI 58 of 2021
- Version
- 14 May 2021
- Language
- en
- Official source
- View official record ↗
Statute overview
About this statute
These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021. This section defines “micro organisation,” “medium organisation,” “large organisation,” and “licensee” for these Regulations. The Data Protection Commissioner must register data controllers and data processors in specified categories and charge different fees for each category. A person intending to act as a data controller or data processor must apply to the Data Protection Commissioner for a certificate of registration in Form I. The Data Protection Commissioner may ask an applicant for more particulars about an application, and the applicant must submit them in Form II within the specified period.
Search within this statute
Search all stored provisions in this version.
Legal text
Provisions of Data Protection (Registration and Licensing) Regulations, 2021
Showing 54 of 54
- 1 Verify source ↗
These Regulations may be cited as the Data Protection
These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021.
1. These Regulations may be cited as the Data Protection Title (Registration and Licensing) Regulations, 2021. - 2 Verify source ↗
Section 2
This section defines “micro organisation,” “medium organisation,” “large organisation,” and “licensee” for these Regulations.
2. In these Regulations, unless the context otherwise requires “ micro organisation ” means an entity with a maximum Interpretation of ten employees; “ medium organisation ” means an entitywith more than ten employees but not more than fifty employees; “ large organisation ” means an entitywith more than fifty employees; and “ licensee ” means a person lincensed to offer data auditing services under regulation 14. - 3 Verify source ↗
(1) The Data Protection Commissioner shall register a
The Data Protection Commissioner must register data controllers and data processors in specified categories and charge different fees for each category.
3. (1) The Data Protection Commissioner shall register a data controller and a data processor in the following category: (a) micro organisation; (b) medium organisation; (c) (d) a large organisation;and an individual. Categories of data controllers and data processors Copies of this Statutory Instrument can be obtained from the Government Printer, P.O. Box 30136, 10101, Lusaka, Price K60.00 each 484 Statutory Instruments 14th May, 2021 Application for certificate o f registration Request for further particulars Issue of certificate o f registration Duration of certificate of registration Rejection of application Renewal of certificate of registration Notice of change of particulars Notice of surrender of certificate o f registration Suspension or cancellation o f certificate of registration (2) The Data Protection Commissioner shall charge different fees for each category as set out in the Second Schedule. - 4 Verify source ↗
A person who intends to operate as a data controller or
A person intending to act as a data controller or data processor must apply to the Data Protection Commissioner for a certificate of registration in Form I.
4. A person who intends to operate as a data controller or data processor shall apply to the Data Protection Commissioner for a certificate of registration in Form I set out in the First Schedule.
Part
Schedule.
- 5 Verify source ↗
The Data Protection Commissioner may, where the Data
The Data Protection Commissioner may ask an applicant for more particulars about an application, and the applicant must submit them in Form II within the specified period.
5. The Data Protection Commissioner may, where the Data Protection Commissioner requires further particulars in relation to an application, request an applicant to submit further particulars, within a specified period, in Form II set out in the First Schedule. - 6 Verify source ↗
The Data Protection Commissioner shall, where the
The Data Protection Commissioner must issue a certificate of registration in Form III if the applicant meets the Act’s requirements.
6. The Data Protection Commissioner shall, where the applicant meets the requirements of theAct, issue a certificate of registration in Form III set out in the First Schedule. - 7 Verify source ↗
The certificate of registration issued under these
A certificate of registration issued under these Regulations is valid for one year.
7. The certificate of registration issued under these Regulations is valid for a period of one year. - 8 Verify source ↗
The Data Protection Commissioner shall, where the Data
If the Data Protection Commissioner rejects an application, the Commissioner must inform the applicant within 14 days.
8. The Data Protection Commissioner shall, where the Data Protection Commissioner rejects an application, inform the applicant within fourteen days from the date of the decision of the rejection in Form IV set out in the First Schedule. - 9 Verify source ↗
A holder of a certificate of registration shall apply for
A holder of a certificate of registration must apply to renew it using Form V in the First Schedule.
9. A holder of a certificate of registration shall apply for renewal of a certification of registration in Form V set out in the First Schedule. - 10 Verify source ↗
A holder of a certificate of registration shall notify the
A holder of a certificate of registration must notify the Data Protection Commissioner of any change in registration particulars using Form VI in the First Schedule.
10. A holder of a certificate of registration shall notify the Data Protection Commissionerof anychangein particulars relating to registration in Form VI set out in the First Schedule. - 11 Verify source ↗
The data controller or data processor shall notify the
A data controller or data processor must notify the Data Protection Commissioner when it stops carrying on business in the data processing or controlling industry.
11. The data controller or data processor shall notify the Data Protection Commissioner, where a data controller or data processor ceases to carry on business in the data processing or controlling industry, in Form VII set out in the First Schedule. - 12 Verify source ↗
(1) The Data Protection Commissioner shall, before the
The Data Protection Commissioner must notify the certificate holder before suspending or cancelling the certificate, and the holder must respond with cause or remedial measures within the notice period.
12. (1) The Data Protection Commissioner shall, before the Data Protection Commissioner suspends or cancels a certificate of registration, notifythe holder of the certificate of registration of the intention to suspend or cancel the certificate of registration in Form VIII set out in the First Schedule. (2) Wherethe holderof thecertificateofregistration is notified of the intention of the Data Protection Commissioner under subregulation, (1) theholder of the certificateof registration shall— 14th May, 2021 Statutory Instruments 485 (i) (ii) show cause whythe certificate of registration should not be suspended or cancelled; or take remedial measures to the satisfaction of the Data Protection Commissioner within the times specified in notice. (3) The Data Protection Commissioner shall, where the holder fails to show cause why the certificate should not be cancelled or suspended or fails to take remedial measures to the satisfaction of the Data Protection Commissioner, cancel or suspend the certificate of registration. (4) Where the Data Protection Commissioner suspends or cancels a certificate of registration under subregulation (3), the Data Protection Commissioner shall, inform the holder of a certificate of registration of the suspension or cancellation of the certificate in Form IX set out in the First Schedule. - 13 Verify source ↗
A person whose certificate of registration issued under
If a person’s registration certificate has been cancelled, they may apply to re-register as a data processor or data controller using Form V.
13. A person whose certificate of registration issued under these Regulations has been cancelled, may apply for re registration as a data processor or data controller in Form V set out in the First Schedule. PART II DATA AUDITOR Application for re- registration
Part
PART II
- 14 Verify source ↗
(1) A person who intends to provide data audit services
A person intending to provide data audit services must apply to the Data Protection Commissioner for a licence in Form I.
14. (1) A person who intends to provide data audit services shall apply to the Data Protection Commissioner for a licence in Form I set out in the First Schedule . (2) A Data Protection Commissioner shall, where the Application for licence applicant— (a) meets the requirements of theAct, issue the applicant with a licence in Form X set out in the First Schedule; or (b) does not meet the requirements of theAct, reject the application and inform the applicant of the rejection in Form IV set out in the First Schedule stating the reasons for the rejection. - 15 Verify source ↗
The licence issued under these Regulations is valid for a
The licence issued under these Regulations is valid for two years.
15. The licence issued under these Regulations is valid for a period of two years. Duration of licence 486 Renewal of licence Transfer of licence Amendment of licence Notice to surrender licence Suspension or cancellation of licence Statutory Instruments 14th May, 2021 - 16 Verify source ↗
A licensee who intends to renew that licencee’s shall,
A licensee who wants to renew a licence must apply to the Data Protection Commissioner at least three months before the licence expires, using Form V.
16. A licensee who intends to renew that licencee’s shall, apply to the Data Protection Commissioner, for renewal of a licence at least three months before the expiry of the licence, in Form V set out in the First Schedule. - 17 Verify source ↗
An application to transfer or assign a licence shall be
An application to transfer or assign a licence must be made to the Data Protection Commissioner in Form XI.
17. An application to transfer or assign a licence shall be made to the Data Protection Commissioner, in Form XI set out in the First Schedule. - 18 Verify source ↗
A licensee may within the validity of the licence, apply
A licensee may apply to the Data Protection Commissioner to amend or vary the licence terms and conditions while the licence is still valid.
18. A licensee may within the validity of the licence, apply to the Data Protection Commissioner for an amendment or variation of the terms and conditions of the licence in Form XII set out in the First Schedule. - 19 Verify source ↗
Alicenseeshall, notifythe DataProtection Commissioner,
A licensee must notify the DataProtection Commissioner in Form VII within one month after it stops providing the licensed services and ceases business.
19. Alicenseeshall, notifythe DataProtection Commissioner, where a licensee ceases to provide the services relating to the licence, within one month of ceasing to carry on business, in Form VII set out in the First Schedule. - 20 Verify source ↗
(1) The Data Protection Commissioner shall, before the
Before suspending or cancelling a licence, the Data Protection Commissioner must notify the licence holder; if the licensee does not show cause or take satisfactory remedial measures within the specified time, the Commissioner must suspend or cancel the licence and inform the licensee.
20. (1) The Data Protection Commissioner shall, before the Data Protection Commissioner suspends or cancels a licence, notify the holder of the licence of the Data Protection Commissioner’s intention to suspend or cancel the licence in Form VIII set out in the First Schedule. (2) The Data Protection Commissioner shall suspend or cancel the licence and inform the licensee in Form IX set out in the First Schedule where a licensee who is notified of the intention to suspend or cancel a licence under sub-regulation (1)— (i) (ii) fails to show cause why the licence should not be cancelled or suspended; or does not take any remedial measures to the satisfaction of DataProtection Commissioner within the specified time. PART III GENERAL PROVISIONS Record of processing activities Data protection impact assessment
Part
PART III
- 21 Verify source ↗
A data controller or data processor shall keep and
A data controller or data processor must keep and maintain a record of processing activities and meta data in Form XIII in the First Schedule.
21. A data controller or data processor shall keep and maintain a record of processing activities and meta data in Form XIII set out in the First Schedule. - 22 Verify source ↗
The data protection impact assessment shall be made in
A data protection impact assessment must be made using Form XIV in the First Schedule.
22. The data protection impact assessment shall be made in Form XIV set out in the First Schedule. 14th May, 2021 Statutory Instruments 487 - 23 Verify source ↗
The Data Protection Commissioner shall keep and
The Data Protection Commissioner must keep and maintain a register, and the public may inspect it during normal working hours on payment of the fee in the Second Schedule.
23. The Data Protection Commissioner shall keep and maintain aregister, which shall be open to inspection bythe public during normal working hours on payment of a fee set out in the Second schedule. - 24 Verify source ↗
The fees set out in the Second Schedule are fees payable
Fees listed in the Second Schedule must be paid for the matters named in that Schedule.
24 . The fees set out in the Second Schedule are fees payable Fees for the matters specified in that Schedule. 488 Statutory Instruments 14th May, 2021 FIRST SCHEDULE (Regulations4, 5,6,8,9,10,11,12,13,14,16, 17, 18, 19, 20, 21 and 22) Form I (Regulations 4 and 14) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 APPLICATION FOR REGISTRATION/LICENCE Shaded Fields for official use only Certificate/License code Date and Time InformationRequired InformationProvided - 7 Verify source ↗
Section 7
This section is an application form for data service-related documents and asks applicants to provide identification and contact details.
7. Type of Document ☐Licence(Data Auditor)☐Certificate (Data Controller and Data Processor) Type of Data Service Data Service Category (Data Auditor Only) Name(s) of applicant(s) (a) Nationality of applicant(s) (b) Identity card of applicant(s) – Attach certified copies ☐ Data Processor ☐ Data Controller ☐Data Auditor ☐ Data Auditor - Public Critical Information Infrastructure☐Data Auditor - Private Public Critical Information Infrastructure☐Data Auditor- General NRC No. Passport No. Type of applicant ☐ Individual ☐ Company ☐ Partnership (a) Notification Address Tell: Email: (b) Information of contact person authorised to represent the applicant Tell: Email: 14th May, 2021 Statutory Instruments 489 - 8 Verify source ↗
Where the applicant is a company, the following details are required
If the applicant is a company, it must provide the company name, company address, and company registration number.
8. Where the applicant is a company, the following details are required: (a) company name: (b) company address: (c) company registration No.: - 9 Verify source ↗
Section 9
This item asks whether the person has ever applied to provide data auditing, data controller, or data processor services in Zambia, and to give details if yes.
9. Have you ever applied to provide data auditing, data controller or data processor services in Zambia? If yes please give details: (a) Service applied for Location Brief description of service Date of application Status of application (Granted, rejected or pending) (b) - 11 Verify source ↗
Section 11
The form asks whether the applicant has ever been convicted of fraud, dishonesty, or certain offences under specified Zambian laws, and asks for details if the answer is yes.
11. If application was rejected, give reasons for rejection: Service commencement details Proposed commencement date: (b) Brief description Have you been convicted of an offence involving fraud or dishonesty or of any offence under the Data Protection Act 2021, Electronic Communication and Transaction Act, 2021 or any of their predecessors, Or any other law within Zambia? If yes, specify details: ……………………………………………………………………………………………………………………………… Nature of offence: …………………………………………………………………………………………………………………………………… Date of Conviction: …………………………………………………………………………………………………………………………………… Sentence: ………………………………………………………………………………………………………………………………………………… - 12 Verify source ↗
Where the applicant is a controller, the following database registration details are required: (To be filled by a Data Controller ONLY)
If the applicant is a controller, the data controller must provide database registration details.
12. Where the applicant is a controller, the following database registration details are required: (To be filled by a Data Controller ONLY) (a) Name of database(s): (b) A description of the information to be stored: (c)What is the information used for? (d)Will/Is the information be passed or shared with other organisation(s)/persons? If ‘Yes’ who and why? (e)Is/Will the information be transferred outside Zambia? If ‘Yes’, where? And why? (f)Detail how the information will/is kept safe and secure. - 13 Verify source ↗
Appendices
This section says the appendices apply only to data controllers and data processors, and the Authority may require other relevant information.
13. Appendices Appendix No. 1 Database Registration Details Applicability Applicable to Data Controller and Data Processor ONLY Appendix No. 2 Such other relevant information as the Authority may require - 14 Verify source ↗
Section 14
The applicant declares that service quality will meet required minimum standards and that application information is true and complete; if information is false or fraudulent, the licence may be revoked.
14. QUALITY OF SERVICE UNDERTAKING I/we declare that the quality of service I/we provide shall meet the minimum requirements set out under the Act or any other law or, guidelines published by the Data Protection Commissioner or any international standard. 490 Statutory Instruments 14th May, 2021 DECLARATION I/we declare that all the particulars and information provided in this application are complete, correct and true and I/we agree that in the event that any of the said particulars and information provided is found to be untrue or fraudulent, the licence will be revoked. - 15 Verify source ↗
Section 15
If the business changes or stops operating under the registration, the applicant must notify the Authority; the registration may then be revoked or revised. If the licence is revoked, any fee paid for the licence is forfeited.
15. I/we agree that in the event of the revocation of the licence, any fee paid to the authority for licence shall be forfeited. I/we declare that in the event that the nature of my/our business changes, or I/we no longer carry out operations in terms of the registration, I/we will notify the Authority in which case my/our registration may be revoked or revised. Declared at ………………………… this ……… days of ………… 20……… by the following persons who are duly authorised to sign for and on behalf of the applicant under the authority of the Power of Attorney or Board resolution which is hereby attached. My Details – Attachments ______________________________ Applicant ___________________________ Officer FOR OFFICIAL USE ONLY _________________________________ Date _________________________________ Date Received by ______________________________________ Officer Date Received____________________________ Amount Received: __________________________________ Serial No. of application: ____________________________ 14th May, 2021 Statutory Instruments 491 Form II (Regulation 5) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 REQUEST FOR FURTHER PARTICULARS To: [Insert Applicant/ Certificate Holder Name]....................................................... In relation to your application for a(n) [Insert Certificate Category Number]...........address of [Insert Applicant/ Certificate Holder’s Current Address]. ]with reference number [Insert Reference [Insert details of further particulars being requested] The failure to submit treated as invalid and shall be rejected. the requested information within [Insert Period] from the date hereof shall lead to your application being Dated this [Insert day] day of [Insert Month] [Insert Year] ……………………………………….. Data Protection Commissioner 492 Statutory Instruments 14th May, 2021 Form III (Regulation 6) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 Certificate No.: ………… In accordance with Section 21 of the Data Protection Act No. 3 of 2021, this INSERT CERTIFICATE TYPE _ is granted by the Data Protection Commissionerto- is granted by the Data Protection Commissioner to INSERT HOLDER NAME INSERT HOLDER ADDRESS for establishment and operation of a INSERT STATION/SYSTEM TYPE for the purpose of carrying on INSERT SERVICE as specified in the Terms and Conditions as shown in the Annexures attached hereto. Date of Issue: …….…...………………… Date of Expiry: …………………………. Initial Fee: ………………………………….. Annual Renewal Fee: ……..………………... ………………………………………………… Data Protection Commissioner 14th May, 2021 Statutory Instruments 493 Form IV (Regulations 8 and 16) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTICE OF REJECTION To [Insert Applicant Name] Applicant Address] Reference Number] your application has been rejected on the following grounds: of[Insert . IN THE MATTER OF [Insert you are hereby notified that The grounds for rejection of the application are shown in the Annexures attached hereto. Dated this [Insert day] day of [Insert Month] [Insert Year] ……………………………………….. Data Protection Commissioner 494 Statutory Instruments 14th May, 2021 Form V (Regulations 9, 13 and 16) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Licensing) Regulations, 2021 APPLICATION FOR REGISTRATION, RENEWAL FOR REGISTRATION/LICENCE Information Required Information Provided Shaded Fields for official use only Certificate/License code Date and Time - 6 Verify source ↗
Section 6
This section is a form asking for renewal or reregistration details and applicant information for data controller or data processor services.
6. Reason for Renewal ☐Renewal☐Reregistration (Data Controller and Data ProcessorONLY) Type of Data Service ☐ Data Processor ☐ Data Controller☐Data Auditor NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership Name(s) of applicant(s) (a) Nationality of applicant(s) (b) Identity card of applicant(s) – Attach certified copies Type of applicant (a) Notification Address Tell: Email: (b) Information of contact person authorised to represent the applicant Tell: Email: - 7 Verify source ↗
Section 7
If the applicant is a company, it must provide the company name, company address, and company registration number.
7. Where the applicant is a company, the following details are required: (a) company name: (b) company address: (c) company registration No.: - 8 Verify source ↗
Section 8
This section asks whether you have ever applied to provide data auditing, data controller, or data processor services in Zambia, and if so to give details.
8. Have you ever applied to provide data auditing, data controller or data processor services in Zambia? If yes please give details: (a) Service applied for Location Brief description of service Date of application Status of application (Granted, rejected or pending) 14th May, 2021 Statutory Instruments 495 pending) (b) (b) If application was rejected, give reasons for rejection: - 10 Verify source ↗
Section 10
The form asks whether the respondent has been convicted of certain offences and, if yes, to provide details.
10. Service commencement details Proposed commencement date: (b) Brief description Have you been convicted of an offence involving fraud or dishonesty or of any offence under the Data Protection Act 2021, Electronic Communication and Transaction Act, 2021 or any of their predecessors, Or any other law within Zambia? If yes, specify details: ……………………………………………………………………………………………………………………………… Nature of offence: - 11 Verify source ↗
Section 11
This section is a form line for recording the date of conviction and the sentence.
11. …………………………………………………………………………………………………………………………………… Date of Conviction: …………………………………………………………………………………………………………………………………… Sentence: ………………………………………………………………………………………………………………………………………………… - 12 Verify source ↗
Appendices
This section lists appendices for database registration information and says they apply only to data controllers and data processors.
12. Appendices Appendix No. 1 Database Registration Information Applicability Applicable to Data Controller and Data Processor ONLY Appendix No. 2 Such other relevant information as the Authority may require - 13 Verify source ↗
Section 13
The applicant declares that the service will meet required standards and that the application information is true, complete, and correct.
13. QUALITY OF SERVICE UNDERTAKING I/we declare that the quality of service I/we provide shall meet the minimum requirements set out under the Act or any other law or, guidelines published by the Data Protection Commissioner or any international standard. DECLARATION I/we declare that all the particulars and information provided in this application are complete, correct and true and I/we agree that in the event that any of the said particulars and information provided is found to be untrue or fraudulent, the licence will be revoked. - 14 Verify source ↗
Section 14
If the business changes or stops operating under the registration, the applicant must notify the Data Protection Commissioner; if the licence is revoked, any fee paid to the authority is forfeited.
14. I/we agree that in the event of the revocation of the licence, any fee paid to the authority for licence shall be forfeited. I/we declare that in the event that the nature of my/our business changes, or I/we no longer carry out operations in terms of the registration, I/we will notify the Data Protection Commissioner in which case my/our registration may be revoked or revised. Declared at ………………………… this ……… days of ………… 20……… by the following persons who are duly authorised to sign for and on behalf of the applicant under the authority of the Power of Attorney or Board resolution which is hereby attached. My Details – Attachments ___________________________ Applicant ___________________________ Officer FOR OFFICIAL USE ONLY _________________________________ Date _________________________________ Date Received by ______________________________________ Date Received____________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 496 Statutory Instruments 14th May, 2021 Form VI (Regulation10) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 CHANGE OF PARTICULARS Shaded Fields for official use only Certificate/Licence code Date and Time Information Required Information Provided Type of Data Service ☐ Data Processor ☐ Data Controller ☐Data Auditor - 4 Verify source ↗
Name of assignee
The section lists assignee details to be provided: name, nationality, and NRC or passport number, with certified copies attached.
4. Name of assignee Nationality Identity card (NRC) No. or Passport No.- (attach certified copies) - 6 Verify source ↗
Section 6
This section is titled “Reasons for changes” and lists items (a) to (f).
6. Reasons for changes (a) (b) (c) (d) (e) (f) - 7 Verify source ↗
Appendix
This is a form for giving notice of an intention to surrender a licence or certificate of registration.
7. Appendix Appendix No. 1 Appendix No. 2 My Details – Attachments Reasons for change of details Such other relevant information as the Authority may require ___________________________ Applicant _________________________________ Date ___________________________ Officer _________________________________ Date 14th May, 2021 Statutory Instruments 497 FOR OFFICIAL USE ONLY Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 498 Statutory Instruments 14th May, 2021 Form VII (Regulations (11 and 19) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTICE OF INTENTION TO SURRENDER LICENCE/CERTIFICATE OF REGISTRATION Information Required Information Provided Shaded Fields for official use only Certificate code Date and Time Type of Data Service ☐ Data Auditor☐ Data Controller☐ Data Processor - 2 Verify source ↗
Section 2
This text appears to be a label for a certificate or licence number and the current holder.
2. Certificate/Licence No. Current Holder - 3 Verify source ↗
Name(s) of assignee(s)
This section lists the information required about the assignee(s): name(s), nationality, details, type, and address.
3. Name(s) of assignee(s) Nationality of assignee(s) Details of assignee Type of assignee Assignee’s Address - 6 Verify source ↗
Appendices
This section contains appendices and form templates for registration, suspension/cancellation notices, licences, and transfer applications.
6. Appendices Appendix No. 1 Appendix No. 2 My Details - Attachments NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership (a) (b) (c) (d) (e) Reasons for surrender Such other relevant information as the Authority may require ___________________________ Holder of certificate of Registration _________________________________ Date ___________________________ Officer _________________________________ Date 14th May, 2021 Statutory Instruments 499 FOR OFFICIAL USE ONLY Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 500 Statutory Instruments 14th May, 2021 Form VIII (Regulation 12 (1) and 20(1)) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTICE OF INTENTION TO SUSPEND OR CANCEL CERTIFICATE OF REGISTRATION To [Insert Applicant/ Certificate Holder Name] In the matter of [Insert Certificate Category ]with reference number [Insert Reference Number] address of [Insert Applicant/ Certificate Holder’s Current Address].You are hearby notified that the Authority intends to *suspend/cancel* your certificate on the following grounds: (a)................................................................................................................................. (b)................................................................................................................................. (c)................................................................................................................................. (d)................................................................................................................................. You are requested to appear before me on the ...........day of...............20............ at the Ministry of Transport and Communications, Lusaka, to show cause why your certificate should not be rejected/take remedial measure to address the concerns raised in paragraphs......to.......above before the ..................day of..............20............... If you fail to *appear before me/take the neccessary remedial measures* before the stipulated date, your certificate will be suspended and subsequently revoked. Accordingly, you are requested to take action to remedy the breaches set out in paragraphs.............(above) within [Insert Number of Days] days of recieving this notice. Failure to remedy the said breaches shall result in the *suspension/cancellation* of your certificate. Dated this Year]……………………………………….. [Insert day] day of [Insert Month] [Insert Data Protection Commissioner *Delete as appropriate 14th May, 2021 Statutory Instruments 501 Form IX (Regulation 12 (4) and 20 (2)) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 NOTIFICATION OF SUSPENSION OR REVOCATION OF CERTIFICATE OF REGISTRATION To [Insert Applicant/ Certificate Holder Name] In the matter of [Insert Certificate Category [Insert Applicant/ Certificate Holder’s Current Address].You are hearby notified that your certificate of registration has been *suspended/revoked* on the following grounds: ]with reference number [Insert Reference Number] address of (a)..................................................................................................................................................................................... (b)..................................................................................................................................................................................... (c)..................................................................................................................................................................................... (d)..................................................................................................................................................................................... Dated this [Insert day] day of [Insert Month] [Insert Year] ……………………………………….. Data Protection Commissioner *Delete as appropriate 502 Statutory Instruments 14th May, 2021 Form X (Regulation 14 (2)) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 In accordance with Section 31 of the Data Protection Act No. 3 of 2021, this Licence No.: ………… INSERT LICENCE TYPE is granted by the Data Protection Commissionerto - INSERT NAME OF LICENCEE INSERT LICENCEE ADDRESS for establishment and operation of a INSERT STATION/SYSTEM TYPE for the purpose of carrying on INSERT SERVICE as specified in the Terms and Conditions as shown in the Annexures attached hereto. Date of Issue: …….…...………………… Date of Expiry: …………………………. Initial Fee: ………………………………….. Annual Renewal Fee: ……..………………... ………………………………………………… Data Protection Commissioner 14th May, 2021 Statutory Instruments 503 Form XI (Regulation 18) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 APPLICATION FOR TRANSFER Shaded Fields for official use only Licence code Date and Time Information Required Information Provided - 3 Verify source ↗
Name(s) of assignee(s)
This section lists the information to be provided about assignees: name, nationality, details, type, and address.
3. Name(s) of assignee(s) Nationality of assignee Details of assignee Type of assignee Assignee’s Address - 5 Verify source ↗
Appendices
This section is an appendix/form page listing attachments and application details for an amendment form.
5. Appendices Appendix No. 1 Appendix No. 2 My Details – Attachments NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership Reasons for transferring Such other relevant information as the Authority may require ___________________________ Applicant _________________________________ Date _________________________________ Date ___________________________ Officer FOR OFFICIAL USE ONLY Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 504 Statutory Instruments 14th May, 2021 Form XII (Regulation 18) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 APPLICATION FOR AMENDMENT Shaded Fields for official use only Certificate code Date and Time Information Required Information Provided Type of Data Service ☐ Data Controller ☐ Data Processor - 6 Verify source ↗
Appendices
This appendix is a form for a data controller to complete with controller details and record-of-processing information.
6. Appendices Appendix No. 1 Appendix No. 2 My Details – Attachments ___________________________ Applicant ___________________________ Officer FOR OFFICIAL USE ONLY NRC No. Passport No. ☐ Individual ☐ Company ☐ Partnership (a) (b) (c) (d) (e) Reasons for amendment Such other relevant information as the Authority may require _________________________________ Date _________________________________ Date Received by ______________________________________ Officer Amount Received: __________________________________ Serial No. of application: ____________________________ 14th May, 2021 Statutory Instruments 505 Form XIII (Regulation 21) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 PART 1- DATA CONTROLLER (To be filled by a Data Controller ONLY) RECORD OF PROCESSING ACTIVITIES Section 1: Controller Details Name and contact details Data Protection Officer (if applicable) Representative (if applicable) Name: Address: Email: Telephone: Name: Address: Email Telephone: Name: Address: Email: Telephone: No.
Part
PART 1- DATA CONTROLLER (To be filled by a Data Controller ONLY)
- 2
This section lists the information fields for a record of processing activities.
2.9. Section 2: Record of Processing Activities Business function Purpose of processing Name and contact details of joint controller (if applicable) Categories of data subjects Categories of personal data Categories of recipients Link to contract with processor Names of other countries or international organisations that personal data are transferred to (if applicable) Safeguards for exceptional transfers of personal data to other countries or international organisations (if applicable) 506 Statutory Instruments 14th May, 2021 - 8
This provision lists data protection topics and headings, including privacy notices, consent, access requests, data breaches, and sensitive personal data or offence data.
8.2. Retention schedule (if possible) General description of technical and organisational security measures (if possible) Section 3: Privacy Notices Lawful basis for processing personal data Condition for processing sensitive personal data Legitimate interests for the processing (if applicable) Link to record of legitimate interests assessment (if applicable) Rights available to data subjects Existence of automated decision-making, including profiling (if applicable) The source of the personal data (if applicable) Section 4: Consent Link to record of consent Section 5: Access Requests Location of personal data Section 6: Data Protection Impact Assessments Data Protection Impact Assessment required? Data Protection Impact Assessment progress Link to Data Protection Impact Assessment Section 7: Personal Data Breaches Has a personal data breach occurred? Link to record of personal data breach Section 8: Sensitive Personal Data or Criminal Conviction and Offence data Condition for processing Lawful basis for processing 14th May, 2021 Statutory Instruments 507 - 8
The form asks whether personal data is retained and erased in line with the policy document.
8.5. Link to retention and erasure policy document Is personal data retained and erased in accordance with the policy document? Reasons for not adhering to policy document (if applicable) PART 2- DATA PROCESSOR (To be filled by a Data Processor ONLY) Section 1: Processor Details Name and contact details Data Protection Officer (if applicable) Representative (if applicable) Name: Address: Email: Telephone: No.
Part
PART 2- DATA PROCESSOR (To be filled by a Data Processor ONLY)
- 2
This form section asks for record-of-processing information, including controller contact details, cross-border data transfers, safeguards for exceptional transfers, and security measures.
2.7. Name: Address: Email Telephone: Name: Address: Email: Telephone: Section 2: Record of Processing Activities Link to contract with controller (If applicable) Name and contact details of controller Name and contact details of controller’s representative (If applicable) Categories of processing Names of other countries or international organisations that personal data are transferred to (If applicable) Safeguards for exceptional transfers of personal data to other countries or international organisations (if applicable) General description of technical and organisational security measures (if possible) 508 Statutory Instruments 14th May, 2021 Form XIV (Regulation 22) REPUBLIC OF ZAMBIA MINISTRY OF TRANSPORT AND COMMUNICATIONS The Data Protection Act, 2021 (Act No. 3 of 2021) The Data Protection (Registration and Licensing) Regulations, 2021 Notes for Applicants - 2 Verify source ↗
Section 2
A data controller must appoint a Data Protection Officer and carry out a Data Protection Impact Assessment.
2. In line with Section 48 of the Data Protection Act 2021, a data controller shall appoint a Data Protection Officer (DPO). In line with Section 46 of the Data Protection Act 2021, a data controller shall carry out a Data Protection Impact Assessment (DPIA) DATA PROTECTION IMPACT ASSESSMENT Section 1: Controller Details Name of controller Subject/title of DPO Name of controller contact /DPO (delete as appropriate) Section 2: Data Protection Impact Assessment Step 1: Identify the need for a DPIA Explain broadly what you aims to achieve with the personal data (PD) and what type of processing it involves. You may find it helpful to refer or link to other documents. Summarise why you identified the need for a DPIA. Step 2: Describe the processing Describe the nature of the processing: How will you collect, use, store and delete data? What is the source of the data? Will you be sharing data with anyone? You might find it useful to refer to a flow diagram or other way of describing data flows. What types of processing identified as likely high risk are involved? 14th May, 2021 Statutory Instruments 509 Describe the scope of the processing: What is the nature of the data, and does it include special category or criminal offence data? How much data will you be collecting and using? How often? How long will you keep it? How many individuals are affected? What geographical area does it cover? Describe the context of the processing: what is the nature of your relationship with the individuals? How much control will they have? Would they expect you to use their data in this way? Do they include children or other vulnerable groups? Are there prior concerns over this type of processing or security flaws? Is it novel in any way? What is the current state of technology in this area? Are there any current issues of public concern that you should factor in? Are you signed up to any approved code of conduct or certification scheme (once any have been approved)? Describe the purposes of the processing: What do you want to achieve? What is the intended effect on data subjects? What are the benefits of the processing – for you, and more broadly? Step 3: Consultation process Consider how to consult with relevant stakeholders: Describe when and how you will seek individuals’ views – or justify why it’s not appropriate to do so. 510 Statutory Instruments 14th May, 2021 Who else do you need to involve within your organisation? Do you need to ask your processors to assist? Do you plan to consult information security experts, or any other experts? Step 4: Assess necessity and proportionality Describe compliance and proportionality measures, in particular: What is your lawful basis for processing? Does the processing actually achieve your purpose? Is there another way to achieve the same outcome? How will you prevent function creep? How will you ensure data quality and data minimisation? What information will you give individuals? How will you help to support their rights? What measures do you take to ensure processors comply? How do you safeguard any international transfers? Step 5: Identify and Assess Risks Identify additional measures you could take to reduce or eliminate risks identified as medium or high risk in step 5 Risk Options to reduce or eliminate risk Effect on risk (Eliminated, Reduced or Accepted) Residual risk (Low, Medium or High) Measure approved (Yes/No) Step 6: Identify measures to reduce risk Identify additional measures you could take to reduce or eliminate risks identified as medium or high risk in step 5 Risk Options to reduce or eliminate risk Effect on risk (Eliminated, Reduced or Accepted) Residual risk(Low, Medium or High) Measure approved(Yes/No) Step 7: Sign off and record outcomes 14th May, 2021 Statutory Instruments 511 Item Name/Position/date Notes Measures approved by: Residual risks approved by: DPO advice provided: Summary of DPO advice: DPO advice accepted or overruled by: Comments: Consultation responses reviewed by: Comments: Integrate actions back into project plan, with date and responsibility for completion If accepting any residual high risk, consult the Data Protection Commissioner before going ahead DPO should advise on compliance, step 6 measures and whether processing can proceed If overruled, you must explain your reasons If your decision departs from individuals’ views, you must explain your reasons This DPIA will be kept under review by: The DPO should also review ongoing compliance with DPIA 512 Statutory Instruments 14th May, 2021 SEOND SCHEDULE (Regulations 3, 23 and 24) PRESCRIBED FEES Category Application Micro Organisation Medium Organisation Large Organisation Data processor 167 333 1000 1000 Certificate of Registration 1,667 3,334 10,000 10,000 Category Application Licence Data auditor-public critical information 3333 entity 1667 individual Data auditor-private critical information Entity/Individual 3333 10,000 entity 16,667individual 33333 entity 16,667 individual Data auditor-general 3333 entity 1667 individual 33333 entity 16667 individual Register Inspection Fee 333 LUSAKA 11th May, 2021 [ MTC.64/9/35 ] M. L. KAFWAYA, Minister of Transport and Communications
Provision text is displayed from LexChat’s stored statute record. Use the official source links to verify amendments, commencement, and current legal force.
Ask AI about this statute
Data Protection (Registration and Licensing) Regulations, 2021
Sign in to ask AI about this statute
Sign in to start authenticated, citation-grounded statute research.
Sign inLexChat organizes source-backed legal information for research. Verify amendments, commencement, and current legal force with the official publisher before relying on it.