The Cyber Security Act, 2025

ARRANGEMENT OF SECTIONS

PART I - PRELIMINARY

1. Short title and commencement
2. Interpretation

PART II - THE ZAMBIA CYBER SECURITY AGENCY

3. Establishment of Zambia Cyber Security Agency
4. Functions of Agency
5. Director-General and other staff

PART III - CYBER INCIDENT RESPONSE TEAMS

6. Zambia Cyber Incident Response Team
7. Constitution of sectoral cyber incident response teams

PART IV - PROTECTION OF CRITICAL INFORMATION AND CRITICAL INFORMATION INFRASTRUCTURE

8. Critical sector
9. Designation of critical information or critical information infrastructure
10. Categories of critical information and critical information infrastructure
11. Registration of critical information and critical information infrastructure
12. Hosting of critical information and critical information infrastructure
13. Change in ownership of critical information or critical information infrastructure
14. Auditing of critical information or critical information infrastructure
15. Non-compliance to cyber audit requirements
16. Report on cyber security situational awareness
17. Duty to report cyber security incidents in respect of critical information and critical information infrastructure
18. Power to investigate cyber security incident and cyber security threat
19. Cyber security exercise
20. Cyber Security Risk Register

PART V - INTERCEPTION OF COMMUNICATIONS

21. Central Monitoring and Co-ordination Centre
22. Prohibition of interception of communication
23. Prohibition of use, manufacture or possession of interception device
24. Registration of interception device
25. Variation of certificate of registration
26. Surrender of certificate of registration
27. Transfer of certificate of registration
28. Cancellation or suspension of certificate of registration
29. Lawful interception
30. Interception of communication to prevent bodily harm, loss of life or damage to property
31. Prohibition of use, acquisition, etc of geolocation and interception information
32. Interception of communication for purposes of determining location
33. Technical assistance for purposes of determining location or illegal use of spectrum
34. Prohibition of access and use of intercepted communication
35. Disclosure of intercepted communication by law enforcement officer
36. Privileged communication to retain privileged character
37. Prohibition of random monitoring
38. Interception of satellite transmission
39. Assistance by electronic communications service provider
40. Interception capability of electronic communications service provider

PART VI - LICENSING OF CYBER SECURITY SERVICE PROVIDERS

41. Cyber security services
42. Prohibition of providing cyber security service without licence
43. Categories of licences
44. Application for licence
45. Grant of licence
46. Rejection of application
47. Variation of licence
48. Surrender of licence
49. Transfer of licence
50. Renewal of licence
51. Cancellation or suspension of licence
52. Register of cyber security service provider

PART VII - INTERNATIONAL COOPERATION IN MAINTAINING CYBER SECURITY

53. Identifying areas of cooperation
54. Entering into agreement

PART VIII - INSPECTORATE

55. Appointment of cyber security inspector
56. Power to access, search and seize
57. Appointment of cyber security technical expert

PART IX - GENERAL PROVISIONS

58. Appeals
59. Search and seizure by law enforcement officer
60. Restoration of property
61. Assistance
62. Evidence obtained by unlawful interception not admissible in criminal proceedings
63. Prohibition of obstruction of law enforcement officer
64. Submission of information by controller
65. General penalty
66. Power of court to order cancellation of licence, forfeiture etc.
67. Guidelines
68. Standards
69. Exemptions
70. Compounding of certain offences by Agency
71. Administrative penalty
72. Regulations
73. Repeal of Act No. 2 of 2021

SCHEDULE

GOVERNMENT OF ZAMBIA

ACT No. 3 of 2025

Date of Assent: 8th April, 2025

An Act to provide for cyber security in the Republic; establish the Zambia Cyber Security Agency and provide for its functions; provide for the regulation of cyber security service providers; provide for the constitution of the Zambia Cyber Incident Response Team and provide for its functions; provide for the constitution of sectoral cyber incident response teams; continue the existence of the Central Monitoring and Co ordination Centre; provide for the designation, protection and registration of critical information and critical information infrastructure; repeal and replace the Cyber Security and Cyber Crimes Act, 2021; and provide for matters connected with, or incidental to, the foregoing.

15th April, 2025

ENACTED by the Parliament of Zambia.