Zambia’s cyber laws: A journey from the Wild West to accountability
Everyday Digital Conversations with Ali Kingston MWILA
THE other day while discussing lucrative farming opportunities with colleagues, my attention was drawn to a nearby table. A group of frustrated individuals were engaged in a heated conversation about Zambia’s Cyber Crimes Act of 2025.
One gentleman’s voice cut through the ambient noise: “Can’t you see how they have silenced everyone on the internet? The so-called Cybercrime Act was meant to silence people. Today people do not have freedom even to say what is straightforward.”
Though this was just an isolated conversation, it reflects a sentiment held by some Zambians. Yet, to understand where we are today, we must look back at how we got here. The cyber space was once a lawless frontier where individuals were harassed, insulted, and bullied with impunity, and companies were accused of anything without consequence. Companies and individual lost money through cyber crimes such as hacking, fraud, and many others. Zambia’s journey toward a regulated cyber space has been long and, at times, contentious.
The early days
Zambia’s first foray into cyber legislation came in 2004 with the Computer Misuse and Crimes Act No. 13 of 2004. Passed unanimously by Parliament without debate, the Act was a response to heavy lobbying by the banking sector, which was concerned about the rising threat of cybercrime.
The Act criminalised unauthorised access to computer programmes or data, unauthorised use or interception of computer services, and the obstruction of computer use. Offenders faced severe penalties, with jail sentences ranging from 15 to 25 years.
However, the 2004 Act had significant limitations. Scholars and legal experts noted that it imposed relatively light sentences for some offences and failed to prohibit other major cybercrimes that were emerging. It was, in many ways, a first step—but an incomplete one.
The Electronic Communications and Transactions Act, 2009
Five years later, the Electronic Communications and Transactions Act No. 21 of 2009 expanded the legal framework. This Act contained provisions for data protection, interception of communications, and offences relating to unauthorised access to, or interference with, data. It criminalised computer-related extortion, fraud, forgery, hacking, viruses, denial of service attacks, and spamming.
Yet, despite these advancements, gaps remained. The Zambia Information and Communications Technology Authority (ZICTA) itself acknowledged that the 2009 Act had “lacunas” that needed to be addressed. The cyber landscape was evolving faster than the law could keep up.
A watershed moment
The year 2021 marked a watershed moment. Zambia repealed and replaced the Electronic Communications and Transactions Act of 2009 with three pieces of legislation: the Data Protection Act, the Electronic Communications and Transactions Act, and the Cyber Security and Cyber Crimes Act No. 2 of 2021.
Enacted on 24 March 2021 and commenced on 1 April 2021, this comprehensive Act sought to provide for cyber security, establish the Zambia Computer Incidence Response Team, protect persons against cybercrime, provide for child online protection, and facilitate the identification and protection of critical information infrastructure.
But the 2021 Act was not without controversy. Its passage followed a “swift and limited consultative process” that drew sharp criticism from civil society organisations, legal practitioners, and digital rights advocates. Shortly after its enactment, Chapter One Foundation and four other civil society organisations filed a petition in the High Court challenging the constitutionality of several provisions. The petitioners argued that the Act violated fundamental human rights, including the right to privacy, freedom of expression, and freedom of the press, as guaranteed by Articles 17 and 20 of Zambia’s Constitution.
The current framework: Cyber Security Act and Cyber Crimes Act, 2025
Following a negotiated settlement between the petitioners and the government, Cabinet approved a process to amend the 2021 Act. The government committed to ensuring that the provisions and enforcement mechanisms aligned with the Constitution and that the review process would be consultative. Provincial consultative meetings were held in all ten provinces.
This reform culminated in the enactment of two new laws on 8 April 2025: the Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025. The Cyber Crimes Act was published in the Government Gazette on 15 April 2025 and commenced on 12 May 2025.
The Cyber Security Act regulates security service providers and critical information infrastructure, while the Cyber Crimes Act establishes a framework for cybercrime offences, provides protection against cyber-enabled crimes, and introduces specific provisions for online child protection.
The new laws repeal and replace the 2021 Act, drawing a clearer distinction between regulatory and criminal law functions. Notably, this legislative overhaul came barely five years after Zambia passed its first comprehensive cyber security law, underscoring the rapid pace of regulatory reform.
The debate: Safety or surveillance?
As with the 2021 Act, the 2025 laws have sparked fierce debate. Supporters hail them as progressive measures to fight digital crimes, protect citizens from identity theft and online fraud, and improve national security. Then Minister of Foreign Affairs Mulambo Haimbe has insisted that the legislation is meant to protect citizens online, not to stifle fundamental freedoms.
However, rights groups and critics maintain that the laws, especially the Cyber Crimes Act, are undemocratic and stifle freedom of expression. The laws allow for the interception and surveillance of all electronic communications, including calls, emails, and messages. The Zambia Cyber Security Agency has been moved from an independent state agency and brought under the Office of the President. Violations carry significant penalties, including fines and prison sentences ranging from two to 25 years.
In July 2025, the Law Association of Zambia (LAZ) petitioned the High Court to declare provisions of the Cyber Crimes Act unconstitutional, arguing that the law infringes on freedom of expression and speech. The Media Institute of Southern Africa (MISA) has reported that journalists are living in fear, engaging in self-censorship, and avoiding investigative journalism. A MISA survey found that 62% of journalists in Zambia believe the press does not operate freely.
A global phenomenon
It is important to note that Zambia is not alone in regulating the cyber space. Countries around the world have enacted cyber laws, though they vary significantly. The debate over the balance between security and freedom is not unique to Zambia—it is a global conversation. Scholars have long argued that there is no such thing as perfect or bad laws; rather, some will agree and some will disagree. The question is whether the laws achieve their intended purpose without disproportionately infringing on fundamental rights.
Conclusion
The evolution of Zambia’s cyber laws—from the Computer Misuse and Crimes Act of 2004, through the Electronic Communications and Transactions Act of 2009, to the Cyber Security and Cyber Crimes Act of 2021, and finally to the Cyber Security Act and Cyber Crimes Act of 2025—reflects a nation grappling with the challenges of the digital age. Each legislative iteration has sought to address the gaps and shortcomings of its predecessor.
While the gentleman at the nearby table may feel that the laws have silenced the internet, the reality is more nuanced. The cyber space cannot be left without laws. These laws are designed to make everyone act responsibly and be accountable for their actions. The challenge for Zambia—and for every nation—is to strike the right balance between protecting citizens from harm and preserving the fundamental freedoms that make the internet a space for open dialogue and democratic participation. Both individuals and institutions need to be protected by the law. Safety is important.
Note: This article was not meant to interpret the law but to raise a positive awareness to be on the side of the law. For comments email: cybermakzm@gmail.com, Phone +260 955 689 574
