The Data Protection Act on the platform
The Data Protection Act No. 3 of 2021 governs how personal data about people in Zambia is collected, used, shared and kept. This lesson shows how the Pamodzi e-Services framework applies the Act in practice: the roles involved, the rules every feature follows, and what that means for you as a data steward. It describes what the platform does; it is not legal advice.
Who is who
| Role on the platform | What they do for data protection |
|---|---|
| Data subject | The citizen or person the data is about. Can see who accessed their data and exercise their rights from their account |
| Data Protection Officer (DPO) | Holds the Data Protection Officer extended role, next to a staff role. Handles data subject requests, approves data-sharing agreements and decides on open data |
| Register custodian | Staff of the ministry that owns a register who hold the register custodian role. Decide who may read it, set the terms of agreements, watch its usage |
| Case handlers | Case officers, supervisors and executives who process applications. See personal data in full only on the cases they open |
| Administrators | Run the system. Do not get silent access to citizens' personal data |
| Partner system | Another organisation's system that reads register data under an agreement |
The DPO role is held next to a staff role, and some DPO actions have no administrator bypass: an administrator cannot approve a data-sharing agreement or decide a data subject request in the DPO's place.
Seven rules every feature follows
- Collect the minimum. A form asks only what the service needs. A data-sharing agreement lists the exact fields a
consumer may read. The Developer Hub stores whether an NRC was verified, never the NRC.
- Trust only verified identity. An NRC counts only when the identity provider marked it verified. A self-declared
NRC never links accounts or grants access to records.
- Mask or withhold sensitive fields. Staff answers mask NRCs, phone numbers, e-mail addresses, passport, bank
and TPIN numbers by role and purpose. Register fields are masked or withheld according to the register pack.
- Never log personal data, secrets or tokens. Audit rows record what happened and which fields, never the
values.
- Audit every read of restricted data and every state change. The trail is tamper-evident (lesson 4).
- Share only under an agreement. Register data leaves its owner only through a data-sharing agreement with a
purpose, legal basis, retention and end date, approved by the DPO (lesson 3).
- Respect retention. Records are kept for their scheduled period and nothing under a legal hold is removed
(lesson 5).
Legal basis and purpose
Every request for register data must state its purpose and legal basis. On the Developer Hub's access request the legal basis is one of:
| Legal basis | Typical use |
|---|---|
| Consent of the data subjects | A service the person asked for and agreed to |
| Performance of a contract with the data subject | A bank checking a customer's company details for an account it is opening |
| A legal obligation of the organisation | A regulator that must check licences by law |
| A public function given by law | A ministry carrying out its statutory duties |
| Vital interests of a person | Emergencies |
| No personal data is requested | Counts, code lists, public registers |
On the platform, a data-sharing request needs a purpose of at least 20 characters and a legal basis, and the custodian may narrow what is asked for, never widen it.
Masking in staff screens
The platform masks personal fields in staff answers by role and purpose:
| Type | Example mask (synthetic) |
|---|---|
| NRC | ••••••/••/0 |
| Phone | •••••••456 |
j•••@example.com | |
| Passport, bank account, TPIN | last 4 characters |
- A case handler sees identity and contact details in full on a case they open (purpose: detail).
- Lists and exports are masked (purpose: list). Finance exports mask payer phone and NRC.
- Bank and TPIN numbers are always masked until revealed.
- Support staff, administrators and auditors see masked values.
To see a masked value in full, an authorised officer asks for a reveal with a reason of 10 to 500 characters. A reveal is limited per officer per hour, written to the citizen-visible access log, and audited with the fields and the reason, never the values. Sending a masked value back in an update is refused, so a mask can never overwrite the real data.
Consent and notices
The consent ledger keeps every consent, acceptance and notification choice a person made, append-only, and the person can read it on their profile. Its kinds:
| Kind | Example |
|---|---|
policy | Accepted the privacy notice |
notifications | Switched off SMS for a category of messages |
sharing | Shared a document by link, or withdrew the link |
declaration | "My answers are true and complete" when submitting |
reuse | Reused a checked document from the document wallet on another application |
Data subject rights do not depend on accepting a notice: the data-requests pages stay open even to a person who has not accepted the current terms.
Example: a case officer's day
A case officer of a fictional MDA opens case EX-2026-000123. They see the applicant's NRC and phone number in full, because they handle the case. The case list they came from showed both masked. Later, a Support colleague needs the applicant's phone number to return a call. Support sees it masked, so they request a reveal with the reason "Return the applicant's call about the missing lease copy". The reveal is recorded. When the applicant opens their case's access history, they see that Support in that ministry viewed their phone number in full, and when, without the staff member's name.
What this means for you as a data steward
- Ask for and approve only the fields a purpose needs.
- Check that the legal basis really fits the purpose.
- Never copy personal data out of the platform into e-mail, chat or spreadsheets.
- Use synthetic data (for example NRC
000000/00/0) in tests, screenshots and training. - When unsure, choose the safer default and raise the question.
Check your understanding
- Which role approves data-sharing agreements, and can an administrator do it instead?
- Name four of the seven rules every feature follows.
- What must a member of staff give to reveal a masked value, and who can see that it happened?
- What is recorded in the consent ledger?
- Why must a request for register data state a legal basis?
Sign in to record your progress.