Zambia

Section 20 creates offences of corrupt transactions with private bodies, and section 50 makes directors and managers of a body corporate liable as if they had committed the offence unless they show they lacked knowledge or consent or took reasonable steps to prevent it. The Act does not itself prescribe a compliance programme.

Section 45 requires employers to establish procedures to protect employees from reprisals, section 10 prohibits occupational detriment for a protected disclosure, and section 38 protects a good-faith disclosure made through the employer's authorised procedure. Section 2(2) applies the Act to private companies and other organisations as well as public bodies.

Section 13 lists grounds for processing, including consent, contract, legal obligation and legitimate interests, and section 15 states that a controller shall not process personal data unless the data subject consents. Sections 58 to 65 give rights of access, rectification, erasure, objection, restriction and portability, and a right relating to automated decisions. Section 19 prohibits controlling or processing personal data without registration.

Section 49(1) requires controllers to notify the Commissioner within twenty-four hours of any security breach affecting personal data processed. Processors notify the controller as soon as practicable (section 49(2)), and data subjects are notified as soon as practicable (section 49(3)).

Section 16 of the Act requires reporting entities to identify customers and verify their identities, including beneficial owners (section 16(6)), and section 24 requires ongoing due diligence on business relationships. Regulation 7 of the 2022 Regulations sets out verification for individuals, bodies corporate, partnerships and trusts, regulation 9 allows simplified measures for the low-risk cases in the Second Schedule, and regulation 10 requires enhanced measures for high-risk customers.

Section 29(1) requires a suspicious transaction report to be submitted not later than three working days after forming the suspicion, and section 29(2) extends the duty to attempted transactions. Section 30 requires currency transaction reports promptly but not later than three working days after the transaction; the Fourth Schedule to the 2022 Regulations sets the reporting threshold at the kwacha equivalent of USD 10,000.