Zambia's Data Protection Act No. 3 of 2021 is now being enforced: the Office of the Data Protection Commissioner became operational in 2025 and set a registration deadline of 30 April 2025 for data controllers and processors. If you hold customer phone numbers and send SMS, you should be registered, have a lawful basis for each kind of message, honour opt-outs and keep your lists secure. This article explains what that means in practice. It is general information, not legal advice.
Last reviewed: 27 October 2026
What changed in 2025
The Data Protection Act was passed in 2021, but for several years there was no functioning regulator. According to Bowmans, the Office of the Data Protection Commissioner (ODPC) became operational in April 2025 and required controllers and processors to register by 30 April 2025. The same summary notes penalties of up to ZMW 200,000, imprisonment of up to five years, or both, for certain offences.
At around the same time, Zambia replaced its 2021 cyber law with the Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025. These deal with security incidents and online crime rather than marketing, but they raise the stakes for anyone holding large contact databases.
Is a phone number personal data?
Yes. A mobile number identifies, or can be used to identify, a person, so it is personal data under the Act. A list of numbers with names, fee balances, loan amounts or church membership is clearly personal data, and some of it, such as health information or religious affiliation, deserves more care than a simple customer list.
That means everything you do with an SMS list counts as processing: collecting it, importing it into an SMS platform, sending messages and keeping delivery logs.
What SMS senders should do now
- Check whether you need to register with the ODPC. Most organisations that hold customer, member or parent lists will be controllers. Check the Commissioner's guidance for thresholds and categories, and register if it applies.
- Map your lists. Write down every list you text: where the numbers came from, what you told people when you collected them, and who in the team can download them.
- Match each message type to a lawful basis. A fee reminder to a parent is part of the service you provide. A promotion to the same parent is marketing and needs consent.
- Make opting out easy and permanent. Include an opt-out in promotions, and use one opt-out list across all campaigns so a number that said STOP is never texted again by mistake.
- Limit access and exports. Give staff the roles they need and no more. In the eSMS dashboard, campaign approvals and team roles keep a junior staffer from sending to the whole list.
- Delete what you no longer need. Old lists of past customers or event attendees are a liability. Set a retention period and stick to it.
- Have a contract with your SMS provider. Your provider is a processor acting on your instructions. Make sure the terms cover security and confidentiality.
Transactional or marketing? A practical split
| Message | Usual category | What you need |
|---|---|---|
| OTP, login code, transaction alert | Transactional | Number collected for the service; clear brand; secure handling |
| Fee balance, loan instalment, appointment reminder | Transactional | Existing relationship; accurate content; respectful tone |
| Order, delivery or collection notice | Transactional | Number given for that order; no marketing add-ons |
| Offer, discount, new product, open day | Promotional | Consent, opt-out in each message, daytime timing |
| Fundraising appeal to non-members | Promotional | Consent and opt-out; be careful with sensitive lists |
The line is not always obvious. A "reminder" that mostly advertises a new loan product is marketing. When in doubt, treat it as promotional.
How this fits with ZICTA's SMS rules
Data protection is not the only rule set. In 2011 ZICTA directed MTN, Airtel and Zamtel to stop promotional SMS between 20:00 and 07:00, to limit promotions to one per day and to give subscribers the option to subscribe or unsubscribe in promotions. It is not clear how strictly that directive is enforced today, but it lines up with the consent and opt-out duties in the Act and is the safest default.
Together, the two give a simple rule for promotions: consent first, one message a day at most, between 07:00 and 20:00, and an opt-out every time.
Consent that holds up
If a complaint ever reaches the Commissioner, you want to show how a person agreed to hear from you. Good consent in Zambia looks like this:
- A tick box or signed form that names the kind of messages ("offers and new stock by SMS") and is not pre-ticked.
- For schools, a line on the admission form that covers fee and event messages, with a separate choice for fundraising.
- For walk-in customers, a short script at the till ("Can we text you offers? You can stop any time"), recorded in your system.
- A record of the date and source for each number, kept with the contact in your SMS platform.
Do not buy or rent lists. People on them have not agreed to hear from you, and complaints from those numbers can also lead networks to block your sender ID.
Sector rules on top
Some sectors have their own regulators whose rules apply alongside the Act. Banks and e-money issuers answer to the Bank of Zambia, which in September 2024 directed e-money issuers to stop several charges, so fee wording in messages must be accurate. Insurers answer to the Pensions and Insurance Authority, and health providers must treat clinical information as sensitive. Our industry pages for banking and cooperatives and healthcare cover these in more detail.
What eSMS Africa does on its side
- Opt-out list: numbers on it are blocked from later sends, across campaigns.
- Two-way short codes in Zambia: STOP replies are recorded as opt-outs automatically. See two-way SMS.
- Team roles and campaign approvals, so only authorised staff can send to large lists.
- Delivery reports and logs you can export when you need to answer a query.
A short checklist for this month
If you only have an afternoon to spend on this, these steps cover most of the risk for a typical Zambian SMS sender:
- Confirm whether your organisation is registered with the ODPC, and if not, find out whether it needs to be.
- List every contact list you text and delete the ones you cannot explain.
- Add an opt-out line to your promotional templates and test that STOP requests reach your opt-out list.
- Review who in the team can export contacts, and remove access for anyone who does not need it.
- Add an SMS consent line to your sign-up, admission or membership form.
None of these steps needs a lawyer, and together they show that you take the Act seriously if a customer ever complains.
Frequently asked questions
Do I have to register with the Data Protection Commissioner to send SMS?
Registration depends on whether you are a data controller or processor within the categories the Commissioner sets, not on SMS as such. Most organisations holding customer or member lists will fall in scope. Check the Commissioner's guidance and register if it applies.
What are the penalties under Zambia's Data Protection Act?
As summarised by Bowmans, certain offences carry fines of up to ZMW 200,000, imprisonment of up to five years, or both. Complaints from recipients are the most likely trigger for scrutiny, so consent records and quick opt-outs are the best protection.
Can I keep texting customers who never opted in?
Service messages linked to an existing relationship, such as receipts and reminders, are generally fine. Promotions are different: if you have no record of consent, ask for it or stop sending marketing to those numbers.
Is this legal advice?
No. This article explains the main points for SMS senders in plain language. For your specific situation, read the Act, check the Commissioner's guidance or ask a Zambian lawyer.
Sources
- Data Protection Act No. 3 of 2021 (ZambiaLII)
- Bowmans - Zambia: Office of the Data Protection Commissioner operational
- Bowmans - Zambia: new laws to strengthen cybersecurity and cybercrime capacities
- ITWeb - ZICTA limits spam (2011 directive)
- Zambia Monitor - Bank of Zambia cracks down on unwarranted charges for e-money services (September 2024)
Compliant SMS is easier with the right tools. See how Zambian organisations handle consent on the Zambia use-case hub and SMS in Zambia, then create an eSMS Africa account to build your list with opt-outs from day one.
