Zambia Data Protection Act No. 3 of 2021 · Last reviewed: 13 June 2026
SuloBase is designed from the ground up to be compliant with Zambia's Data Protection Act No. 3 of 2021. Data sovereignty is not a feature we added — it is the foundation of our architecture. By using SuloBase, your application inherits this compliance by default.
Overview
The Data Protection Act No. 3 of 2021 ("the Act") is Zambia's primary legislation governing the collection, processing, storage, and transfer of personal data. It establishes rights for data subjects and obligations for data controllers and processors operating in Zambia.
Sulocorp Technologies Limited operates SuloBase as both a data controller (for customer account data) and a data processor (for data stored in customer projects on behalf of the customer). This document outlines how SuloBase meets the obligations of the Act in both capacities.
Compliance Status
Data localisation — all data stored within Zambia✓ Compliant
Lawful basis for processing customer data✓ Compliant
Data subject rights (access, erasure, portability)✓ Compliant
72-hour breach notification capability✓ Compliant
Data Processing Agreement available for customers✓ Compliant
Privacy Policy published and accessible✓ Compliant
Data Protection Commissioner registrationIn Progress
Data Localisation
Section 18 of the Act restricts the transfer of personal data outside Zambia without appropriate safeguards. SuloBase satisfies this requirement by design:
Database Storage
All PostgreSQL databases are provisioned and stored on infrastructure physically located in Lusaka, Zambia.
File Storage
All file uploads and object storage are hosted on Zambian infrastructure. No data is mirrored to foreign CDNs without explicit configuration.
Authentication Data
User authentication records, sessions, and tokens are stored and processed locally — never routed through overseas identity providers.
Logs & Audit Trails
All system logs, API access records, and audit trails are retained on Zambian infrastructure for the statutory retention period.
Data Controller vs. Data Processor
SuloBase as Data Controller
When we collect and process your account information (name, email, billing details), we act as a data controller. We determine the purpose and means of processing, and we are bound by the Act's obligations on controllers.
SuloBase as Data Processor
When your application stores end-user data in your SuloBase project, we act as a data processor on your behalf. You remain the data controller for your end users' data and are responsible for:
Obtaining lawful consent from your end users
Publishing your own privacy policy to your end users
Registering as a data controller with the Zambia Data Protection Commissioner where required
Ensuring your use of SuloBase complies with the Act's requirements for your specific use case
We provide a Data Processing Agreement (DPA) to all Business and Enterprise customers. Contact tech@sulocorp.com to request a DPA.
Data Subject Rights
The Act grants individuals the following rights, which SuloBase supports both for our own customers and as a processor for your applications:
Right to access — we provide data exports on request within 21 days
Right to rectification — account data can be updated directly in your dashboard
Right to erasure — account and project deletion is available self-service; data purged within 30 days
Right to data portability — full database exports available in standard PostgreSQL format at any time
Right to restrict processing — available on request via tech@sulocorp.com
Security Measures
The Act requires data controllers and processors to implement appropriate technical and organisational measures to protect personal data. SuloBase implements:
Encryption in transit: TLS 1.2+ on all connections
Encryption at rest: AES-256 on all storage volumes
Access controls: Role-based access limiting personnel access to production systems
Network isolation: Tenant databases are network-isolated from each other
Automated backups: Daily backups with 7-day retention
Audit logging: All administrative access to production systems is logged
Breach Notification
In the event of a personal data breach, we will:
Notify affected customers within 72 hours of becoming aware of the breach
Notify the Zambia Data Protection Commissioner within 72 hours where required
Provide a written incident report detailing the nature of the breach, data affected, and remediation steps taken
Data Protection Commissioner
Sulocorp Technologies Limited is in the process of registering with the Zambia Data Protection Commissioner as required under the Act. Enterprise customers requiring confirmation of registration status may contact us at tech@sulocorp.com.
Contact Our Data Protection Lead
For all data protection enquiries, DPA requests, or to exercise your rights: