Built for Zambia

Data Protection Act compliance for institutions that hold customer data

Zambia's Data Protection Act No. 3 of 2021 regulates how personal data is collected, processed, stored and shared. It established the Office of the Data Protection Commissioner, which registers data controllers and processors, and it gives individuals rights over their data, including access, correction and erasure. Institutions that hold customer, member or subscriber data must register, process data lawfully and for a stated purpose, secure it, respond to data subject requests and notify breaches as the Act and its regulations require.

ERMAML, the Ontech Risk & Compliance Suite, supports these obligations by encrypting personal data at the column level, running a right-to-erasure workflow with an audit chain, applying retention policy, and tracking data protection obligations in the compliance register alongside the institution's other regulatory duties. Ontech Solutions is itself a registered data controller with the Office of the Data Protection Commissioner, certificate DP000394.

Request a Demo See the product tour

Key capabilities

PII column encryption

Personal data fields such as identifiers and contact details are encrypted at the column level in the database.

Right-to-erasure workflow

Data subject erasure requests are logged, actioned and evidenced through a workflow with a tamper-evident audit chain.

Retention policy

Retention rules are applied to customer records so data is not kept beyond the period the institution has defined.

Obligations register

Data protection duties are recorded as obligations mapped to controls and evidence, with owners and review dates.

Access control and audit

Role-based access with branch scoping limits who can see personal data, and every access-relevant change is logged.

Incident register

A suspected data breach is recorded as an incident linked to the failed control, supporting the institution's notification and remediation process.

In-country hosting

The platform is hosted at Infratel's Tier III facility in Lusaka, keeping customer data within Zambia.

How it works

  1. The institution records its data protection obligations in the compliance register and assigns owners.
  2. Personal data captured during KYC and case work is stored with column-level encryption and covered by the retention policy.
  3. Access is restricted by role and branch, and reviewed as part of the control self-assessment cycle.
  4. A data subject request is logged, routed to the responsible officer, actioned and evidenced in the workflow.
  5. A suspected breach is raised as an incident, linked to the relevant control, and tracked to closure.
  6. Evidence for the Commissioner or an auditor is produced from the register rather than assembled afterwards.

Benefits

Data protection managed like any other obligation

The same register, owners and evidence trail cover the Data Protection Act and the sector regulators.

Requests handled on record

Erasure and access requests are actioned through a workflow that shows what was done, by whom and when.

Less exposure

Encryption, scoped access and retention limits reduce the data an incident can expose.

Evidence for registration and audit

Controls and evidence are ready when the Commissioner, an auditor or a customer asks.

Who it is for

  • Data protection officers and compliance officers at registered controllers and processors.
  • Institutions holding large volumes of NRC numbers, contact details and financial records.
  • ICT and information security teams responsible for access control and incident response.
  • Boards that need assurance data protection obligations are tracked alongside prudential and AML duties.

Zambia-specific considerations

The Data Protection Act applies to any organisation processing personal data in Zambia, which in practice covers every bank, insurer, pension fund, telecom and public body. The Office of the Data Protection Commissioner maintains the register of controllers and processors and can enforce the Act. Alongside it, the Cyber Security Act 2025 places obligations on operators of critical information infrastructure, which adds a security dimension to how customer data systems are run.

AML and data protection obligations meet in the KYC file: an institution must collect and keep identity data for AML purposes while limiting, securing and eventually erasing it under data protection law. A compliance platform has to hold both sets of rules at once, which is why retention policy, encryption and the erasure workflow sit inside ERMAML's customer record rather than in a separate tool. Breach notification duties and timelines are set by the Act and its regulations; institutions should confirm them with the Commissioner's office.

How ERMAML addresses this

Encryption and erasure built into the customer record

PII column encryption, a right-to-erasure workflow with an audit chain and configurable retention policy are part of the platform, not add-ons.

One register for every obligation

Data protection duties sit in the compliance register next to AML, prudential and sector obligations, with the same owners, controls and evidence.

A registered controller as your vendor

Ontech Solutions holds data controller registration DP000394 and hosts the platform in Lusaka at Infratel's Tier III facility.

Frequently asked questions

What does the Data Protection Act 2021 require?

Lawful, purpose-limited processing of personal data; registration of controllers and processors with the Office of the Data Protection Commissioner; appropriate security; respect for data subject rights such as access, correction and erasure; and notification of breaches as set out in the Act and its regulations. Specific procedures and timelines should be confirmed with the Commissioner's office.

Who is the Data Protection Commissioner?

The Office of the Data Protection Commissioner is the regulator established by the Data Protection Act No. 3 of 2021. It registers data controllers and processors, receives complaints and enforces the Act.

Does AML record-keeping conflict with the right to erasure?

Both apply. AML law requires institutions to keep customer and transaction records for a defined period, and data protection law limits retention to what is necessary. A compliance system should apply the AML retention period and then erase, and it should be able to show why data was kept. ERMAML applies retention policy and evidences erasure requests.

How does ERMAML protect personal data?

Personal data fields are encrypted at the column level, access is restricted by role and branch, every change is logged in a tamper-evident audit trail, and the platform is hosted in Zambia at Infratel's Tier III facility in Lusaka.

Is Ontech Solutions registered under the Act?

Yes. Ontech Solutions is a registered data controller with the Office of the Data Protection Commissioner, certificate DP000394.

Sources

See ERMAML on your own data

Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.

Request a Demo See the product tour

Last updated 2026-09-13. Published by Ontech Solutions, Lusaka, Zambia.