What does the Data Protection Act 2021 mean for compliance systems?

Two regimes, one dataset

AML law says keep the customer's identification records and transaction history for a prescribed period and make them available to the FIC and supervisors. Data-protection law says process personal data lawfully, for a specified purpose, securely and no longer than necessary. The two are reconcilable because compliance with a legal obligation is a lawful basis for processing, but the reconciliation has to be designed in: retention schedules that reflect the AML period, access restricted to those who need it, and a documented answer to a data subject who asks for erasure while the AML retention clock is still running.

Registration and accountability

Controllers and processors register with the Office of the Data Protection Commissioner. A regulated institution is the controller of its customers' data; a software vendor hosting that data on the institution's behalf is a processor. Procurement should confirm the vendor's registration status, the processing agreement in place, and where the data physically resides. Ontech Solutions, for reference, is registered as a data controller with the Commissioner.

Security obligations in practice

The Act expects appropriate technical and organisational measures. For a compliance system that translates into encryption of personal-data fields at rest, encryption in transit, role-based access with the least privilege, branch or unit scoping so staff see only their own customers, and an audit log of who accessed what. Column-level encryption of identifiers such as NRC numbers is a practical way to limit the impact of any database exposure.

• Encrypt PII columns and secrets, not just the disk.
• Scope access by role and by branch or business unit.
• Log access and changes in a tamper-evident audit trail.
• Test backups and restore, and keep them under the same controls.

Data subject rights and the erasure question

The Act gives data subjects rights over their data, including access and, in defined circumstances, erasure. For a compliance system the operational challenge is a request for erasure from a customer whose records the institution is legally obliged to retain. The workable design is a workflow that logs the request, checks the applicable retention obligation, erases or anonymises what can lawfully be removed, and records the justification for what is kept. The clock the institution runs on such requests should follow the Act and the Commissioner's guidance.

Breach response

The Act provides for notification of personal-data breaches. An institution needs to be able to detect that a breach has happened, establish which data subjects are affected, and notify within the period the law sets, which means the compliance system's access logs and data inventory have to be good enough to answer those questions quickly. Treat the breach-response procedure as part of the incident register rather than a separate document.

Hosting and cross-border transfer

Where personal data is hosted, and whether it leaves Zambia, is a question the Act and the Commissioner's guidance address. Many institutions now specify in-country hosting for customer data in their procurement, and ask vendors to show the hosting arrangement in writing. This sits alongside the Cyber Security Act 2025 obligations that apply to operators of critical information infrastructure.

How ERMAML handles this

ERMAML, the Ontech Risk & Compliance Suite, is hosted in Zambia, applies column-level encryption to PII, scopes access by role and branch, keeps a hash-chained audit trail, and provides a right-to-erasure workflow that records the retention justification for data that must be kept. See Data Protection Act compliance.