You left. Your records did not. A bank in Lusaka still holds your account history, an insurer still holds a claim file, a telecoms company still holds a SIM registration, and a former employer still holds a personnel folder with your national identity number in it. From another time zone, all of that feels unreachable.
It is not. Zambia has a data protection statute with a named regulator, a written right of erasure and a complaint route, and none of it requires you to be physically present. What it does require is that you ask the right party for the right thing in writing, and that you keep the trail. This guide is that sequence.
Chasing an administration from abroad has its own costs — calls, certified copies, courier charges, sometimes a trip. Keeping a small local income running covers them: with I am Beezy each piece of content you view generates an earning, and the reference band of 5 to 15 EUR a day is about ZMW 110 to ZMW 329 at the Bank of Zambia rate of 1 EUR = 21.9030 ZMW on 5 August 2026.
What the law actually gives you
The Data Protection Act No. 3 of 2021 sets out the rights of data subjects in its own Part, and they are more specific than most people assume. Knowing which one you are exercising is what makes a request answerable.
Access comes before erasure
Section 58 gives you the right to be told what personal data is being processed and to access it in a form you understand. Start there, always. You cannot sensibly ask for something to be deleted until you know what is held, who holds it and on what basis. An access request also creates a dated record that the controller has acknowledged you, which is exactly what you will need later if the matter escalates.
Erasure, without undue delay
Section 60 provides the right to erasure and requires the controller to act without undue delay. The Act does not fix a number of days for a general request, which cuts both ways: it gives the controller no deadline to hide behind, and it gives you no automatic date to point at. Set a reasonable one yourself in the letter, and say what you will do when it passes.
The rights next to it
Erasure is not always what you want. Section 59 covers rectification of inaccurate data, section 61 the right to object to processing, section 63 restriction of processing and section 65 data portability. If a bank must keep a record for its own regulatory reasons, restriction or objection may get you what you actually wanted — that the data stops being used — where deletion would simply be refused.
Who is still holding your data at home?
Most people underestimate the list, then send one letter to the most obvious name and assume the rest followed. They do not. Each controller is a separate legal person with its own obligation to you.
The controllers a diaspora reader usually forgets
Banks and building societies, insurers and their brokers, telecoms operators, employers and former employers, schools and universities, landlords and letting agents, hospitals and clinics, and any online service that registered you with a Zambian identity document. Write the list before you write the first letter, because sending them in one batch makes the follow-up manageable.
A mobile wallet is not the same company as the operator
This one matters here. MTN Mobile Money, Airtel Mobile Commerce and Zamtel Mobile Money are separate legal entities from their telecoms parents, each designated individually by the Bank of Zambia. A request to the operator does not automatically reach the wallet company. Address them separately and say so in the letter, or you will get a partial answer and think it was a complete one.
Processors and agents hold copies too
Controllers use processors, and processors keep copies. Ask the controller, in the same letter, to confirm which processors received your data and to instruct them accordingly. Under section 20 controllers and processors are themselves registered with the Commissioner, so it is fair to ask whether the party you are dealing with is registered.
| Type of controller | What to ask for first | Realistic outcome |
|---|---|---|
| Bank or building society | Access under section 58, then restriction under section 63 | Retention often justified; usage can still be limited |
| Telecoms operator and its mobile money entity | Two separate requests, access then erasure | Closed-account data is the most deletable category |
| Insurer or broker | Access, then erasure of data from settled and closed files | Claim files are usually retained; marketing data is not |
| Former employer, school or landlord | Access, then erasure or objection under section 61 | Often the quickest to comply, because the file has no live purpose |
Writing a request that cannot be quietly dropped
A request that is vague gets a vague answer, and a vague answer is how six months pass. Four elements make a letter hard to ignore, and none of them requires a lawyer.
Identify yourself the way their record does
Give the names in the order the institution holds them, the identity document number they used, the account or policy number, and the dates of the relationship. If you have changed name since, say so and enclose the evidence. Most delays at this stage are not resistance — the controller genuinely cannot find you, and says nothing rather than admitting it.
Name the right, not the feeling
Write that you are exercising the right of access under section 58 and the right to erasure under section 60 of the Data Protection Act No. 3 of 2021. Naming the provision changes who inside the organisation the letter reaches. A message that says you would like your details removed goes to a service desk; one that cites the statute tends to reach someone with authority to act.
Ask for a confirmation, and set a date
Ask for written confirmation of what has been erased, what has been retained, and the legal basis for anything retained. Give a date by which you expect the reply and state that you will otherwise complain to the Data Protection Commissioner. That single sentence changes the handling of a letter more than any amount of insistence.
Keep the trail from the first message
Send by a method that produces proof of delivery, keep a copy of everything, and log the dates. If a call happens, follow it with a short email summarising what was said. From abroad this record is the whole of your position: you cannot walk into a branch, so what you can show is what you have.
Funding a long paperwork chase with I am Beezy
Pursuing an institution from another country is not free and it is rarely quick. Certified copies, international calls, courier fees and occasionally a relative's time all cost money in kwacha. I am Beezy is an application where you view content — videos, articles, advertisements — and each view generates an earning credited to your account, which is a way of funding those costs in the currency they are billed in.
How the earnings work
The reference band on the platform is 5 to 15 EUR a day, about ZMW 110 to ZMW 329 at the Bank of Zambia rate of 1 EUR = 21.9030 ZMW on 5 August 2026, and it settles onto a local payment method. That last point is the useful one from abroad: the money lands where the fees have to be paid, not where you happen to be living.
Why a live local rail matters when you live abroad
The practical difficulty of dealing with home institutions is rarely the money itself, it is having a working local payment method to send it through. Keeping a small local stream active keeps the wallet and the account alive, which is exactly what you need when a fee has to be paid in Lusaka on a Tuesday and you are five thousand kilometres away.
What happens if the controller refuses?
Refusal is not the end of the sequence, and it is not always unlawful. Two routes exist, and one of them has a hard deadline you can miss without noticing.
Complain to the Data Protection Commissioner
Section 68 lets a data subject lodge a complaint with the Data Protection Commissioner where processing contravenes the Act. The Office of the Data Protection Commissioner is the regulator established by Part II of the Act. Enclose your original request, proof of delivery and the reply or the absence of one. A complaint with a clean paper trail is a different document from a complaint that begins with a story.
Appeal to the High Court within thirty days
Section 69 allows an appeal to the High Court within thirty days of the Commissioner's decision. That window is short and it runs from the decision, not from when you happened to read it. If you are abroad, arrange in advance for someone to receive correspondence on your behalf, because thirty days can pass while a letter is in transit.
When a refusal is lawful
The Act contains exemptions in its own Part, covering national security and public order, law enforcement purposes, legal proceedings, research and archiving, and journalistic purposes. Data being processed to comply with a legal obligation or in the exercise of official authority is likewise outside the reach of an ordinary erasure request. If your refusal cites one of these, the productive next step is restriction or objection, not a complaint that will fail.
The cross-border rules that affect your request
Two provisions in the Act change how a request from abroad behaves, and both are worth citing when a controller tells you your data has simply gone overseas.
Storage inside the Republic is the default
Section 70 requires controllers to process and store personal data on a server or in a data centre located in the Republic, and states expressly that sensitive personal data must be processed and stored on a server or in a data centre located in the Republic. A controller who tells you the data now sits with a foreign parent company and is therefore out of reach has not answered your question.
Transfers abroad are conditional
Section 71 permits transfers outside the Republic where the data subject consents and the transfer uses standard contracts or intragroup schemes approved by the Commissioner, or where the Minister has prescribed the category as permissible. Ask which of those applies. The answer tells you whether there is a second copy abroad and, if so, under what instrument you can reach it.
What this means for you in practice
You are not disadvantaged by being outside the country. The obligations sit on the controller, the storage is meant to be domestic, and the complaint route runs to a Zambian regulator. Distance costs you time and postage, not rights.
| Step | What you send | What you expect back |
|---|---|---|
| 1. Access request | Identity evidence, account references, request under section 58 | A statement of what is held and why |
| 2. Erasure request | Request under section 60, with a date for reply | Confirmation of what was erased and what was retained |
| 3. Escalation | Complaint to the Data Protection Commissioner under section 68 | A decision by the Commissioner |
| 4. Appeal | Appeal to the High Court under section 69 | Must be lodged within thirty days of the decision |
A workable sequence, in order
Doing this well is mostly about order and patience. Sent in the wrong sequence, the same four letters produce refusals instead of results.
List, then access, then erase
Write the full list of controllers first. Send access requests to all of them in one week so the replies arrive together. Only then decide, controller by controller, whether you want erasure, restriction or objection. Batching the work like this turns a year of intermittent frustration into about two months of scheduled follow-up.
Before you leave, and after you arrive
If a move is still ahead of you, close what you can while you are in the country and keep the closure letters — a closed relationship is the easiest one to have erased later. If you have already gone, nominate a contact address in Zambia for formal correspondence. And keep a live local income while the process runs: each piece of content you view on I am Beezy generates an earning paid to a local method, which keeps the wallet you need for local fees active from wherever you are.
