# Zambia External Approval Gate Refresh — 2026-07-18

**Status:** Official-source refresh and stop-gate confirmation. This is not qualified legal advice or an approval to process real participant data.

## Data protection

Current Zambia Data Protection Commission materials confirm that controllers and processors must use the registration process and provide the processing purpose, data categories, lawful basis, risks, mitigations, recipients and data-flow details. The official portal separately asks whether information is transferred or stored outside Zambia and states that separate authorization is required when applicable.

DIREKT has not recorded:

- an approved Zambia legal entity/operating applicant;
- controller or processor registration certificate;
- approved controller/processor allocation;
- overseas storage or transfer authorization;
- an approved DPO arrangement;
- counsel-approved participant notice, consent, retention and withdrawal terms.

**Gate:** no real participant, precise-location, identity, evidence or contact data may be entered until these records are accepted.

Official references:

- https://www.dataprotection.gov.zm/registration/
- https://registration.dataprotection.gov.zm/
- https://www.dataprotection.gov.zm/resources/

## Electronic transactions and ICT

ZICTA continues to publish the Data Protection Act No. 3 of 2021, Cyber Security and Cyber Crimes Act No. 2 of 2021 and Electronic Communications and Transactions Act No. 4 of 2021.

DIREKT has not recorded qualified review of electronic acceptance, notices, signatures, consent-at-send, incident duties or evidence preservation.

**Gate:** synthetic authentication and disabled communication adapters remain mandatory.

Official reference:

- https://www.zicta.zm/resources/legislation

## Consumer and marketplace protection

The Competition and Consumer Protection Commission continues to operate consumer-protection and complaint-resolution functions. DIREKT has not recorded qualified review of subscription disclosure, cancellation, provider-independence wording, complaint redress, refunds, sponsored placement or limitation terms.

**Gate:** no unrestricted public marketplace, public trust claims or paid subscription launch.

Official reference:

- https://www.ccpc.org.zm/

## Payments

The Bank of Zambia states that a person intending to conduct payment business requires designation under the National Payment Systems framework and maintains a current registered-institutions directory.

DIREKT has not recorded:

- classification of its proposed funds flow;
- a designated provider contract for the exact product;
- merchant/KYC and settlement approval;
- refund, reversal, reconciliation and safeguarding ownership;
- AML/KYC/sanctions responsibility allocation.

**Gate:** `PAYMENT_PROVIDER_MODE=disabled`; no real-money movement.

Official references:

- https://www.boz.zm/payment-systems/designation-of-payment-systems
- https://www.boz.zm/financial-stability/registered-financial-institutions

## Entity, tax and invoicing

PACRA remains the official Zambia business-entity registry. Zambia Revenue Authority materials continue to require TPIN/tax registration as applicable and provide Smart Invoice registration guidance.

DIREKT has not recorded a launch entity, TPIN, applicable tax-type determination, VAT/turnover-tax analysis, Smart Invoice determination or approved invoice/credit-note format.

**Gate:** synthetic invoices and receipts remain non-tax artifacts; no production billing.

Official references:

- https://www.pacra.org.zm/
- https://www.zra.org.zm/faq/
- https://www.zra.org.zm/smart-invoice-registration-guide/

## Provider and authority integrations

No production maps, OTP/communications, payment or registry provider has been approved. Public websites and developer sandboxes do not establish lawful automated access, production availability, commercial acceptance or data-processing terms.

**Gate:** all external adapters remain disabled or synthetic/manual. Phase 11 may use only separately approved tools within its bounded entry contract.

## Phase 10 determination

The external-provider and legal package is current enough to support explicit technical stop gates for Phase 10. It does not remove the legal and operational prerequisites for a real-participant Phase 11 pilot.
