DATA PROTECTION

Data Protection

Visionary Students Initiative (VSI), a registered NGO in Zambia, is committed to responsible handling of personal data and to protecting the privacy and rights of the people who interact with our organisation.

Last updated: 5 September 2026

Our approach

VSI seeks to collect personal data for clear and legitimate purposes, use only what is reasonably necessary, keep information accurate, protect it against unauthorised access and retain it only as long as necessary for the relevant purpose and applicable legal requirements.

Your data protection rights

Under applicable Zambian data protection law, data subjects may have rights including access to personal data, correction of inaccurate data, withdrawal of consent where consent is the basis for processing, and other rights provided by law. Requests will be considered in accordance with the applicable legal requirements, including identity and security checks where necessary.

Children's data

Where VSI processes personal data belonging to a child, we will apply appropriate safeguards and parental or guardian consent requirements where applicable. We will also take reasonable steps to avoid collecting more information from children than is necessary for the relevant service or programme.

Security and incidents

VSI uses technical and organisational measures appropriate to the nature and risks of the information we process. If a personal-data or cyber-security incident occurs, VSI will assess it and take appropriate response, mitigation, notification and reporting steps required by applicable law.

Data processors and service providers

VSI may use trusted technology providers to host websites, store information, send communications, provide security or support online services. Where such providers process personal data on VSI's behalf, we will seek appropriate contractual, technical and organisational safeguards.

International processing

Some technology providers may process or store information outside Zambia. Where personal data is transferred or made available outside Zambia, VSI will apply the safeguards and legal requirements applicable to such processing.

Relevant Zambian legal framework

Data Protection Act, 2021 (Act No. 3 of 2021): regulates the collection, use, transmission, storage and other processing of personal data, establishes the Office of the Data Protection Commissioner, and provides rights and duties for data subjects, controllers and processors.
Data Protection (Registration and Licensing) Regulations, 2021 (Statutory Instrument No. 58 of 2021): provides, among other matters, for registration categories for data controllers and processors and licensing of data auditors.
Electronic Communications and Transactions Act, 2021 (Act No. 4 of 2021): provides the legal framework for electronic communications and transactions and supports confidence and security in electronic services.
Cyber Security Act, 2025 (Act No. 3 of 2025): establishes the current Zambian cyber-security framework, including the Zambia Cyber Security Agency and provisions concerning cyber security, incidents and critical information infrastructure. It repealed and replaced the Cyber Security and Cyber Crimes Act, 2021.
Non-Governmental Organisations Act, 2009 (Act No. 16 of 2009), as amended: provides the framework for registration, coordination, transparency, accountability and performance of NGOs operating in Zambia.

Privacy enquiries and requests

For a privacy or data protection request, contact vsizambia@gmail.com or +260 968 623 786. Please describe the request clearly. VSI may need to verify the identity of the requester before releasing or changing personal information.

Legal note: This page provides general information about VSI's data protection approach and is not legal advice. Where the law changes or VSI introduces new processing activities, this information may be updated.