The framework
Zambia regulates personal data through the Data Protection Act 2021, supervised by the Office of the Data Protection Commissioner.
For advertisers the consent posture matters most, and Zambia sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Data Protection Act 2021
Zambia's 2021 Act pairs a GDPR-style rulebook with a localization rule for sensitive data; the Commissioner's office has been registering controllers since 2022-2023.
Marketing and advertising
Consent or listed bases; registration required. Most channel decisions here follow from that consent rule.
Cross-border transfers
Sensitive personal data must be processed and stored on a server or data center in Zambia; other transfers need conditions met.
Enforcement and penalties
Some violations bring fines up to 2% of annual turnover. A ceiling means little until the authority uses it, so its docket is the better guide.