On March 24, 2021, the Zambian parliament enacted its first data protection law when it went into effect in April 2021. The Data Protection Act No. 3 of 2021 regulates the collection, use, transmission, storage, and processing of personal data. In addition, the law created the Office of the Data Protection Commissioner; established responsibilities for data controllers and data processors, like mandated notification to the commissioner within 24-hours of any security breach affecting personal data; and created norms for the cross-border transfer of personal data, like requiring processing and storage of data on servers in Zambia subject to exceptions granted by the minister. Those data controllers and processors that do not comply with the law face sanctions including fines from 100 million to 500 million penalty units or 2% of annual turnover of the preceding financial year, or up to 5 years imprisonment.