Zambia
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Zambia enacted the Data Protection Act No. 3 of 2021 and the Cyber Security and Cyber Crimes Act No. 2 of 2021, both in force from 1 April 2021. The Cyber Security Act provides broad extra-territorial reach — it applies to all natural and artificial persons regardless of nationality or location where the conduct has effects in Zambia. The Act criminalises unauthorised access; the definition of "unlawful" is partly shaped by ToS and C&D notice. The Data Protection Act is enforced by the Office of the Data Protection Commissioner, which commenced formal enforcement from March 2025. Zambia's copyright framework (Copyright and Performance Rights Act 1994) recognises compilations as creative works but no sui generis database right exists. No TDM exception exists. No scraping-specific case law. Public-page crawling of non-personal data is tolerable; personal-data collection requires a lawful basis; the broad extra-territorial scope is notable for operators outside Zambia crawling Zambian websites.
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | without permission |
| Public-page carve-out | unsettled |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | fair dealing narrow |
| Text and data mining — commercial status | unsettled |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | Data Protection Act No. 3 of 2021 (Office of the Data Protection Commissioner) |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-23. Confidence: medium. Not legal advice.