Journalists urged to Learn Cybersecurity laws

Zambia's legal framework governing cybersecurity has undergone significant evolution, culminating in the enactment of the Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025. These statutes, which replaced the Cyber Security and Cyber Crimes Act No. 2 of 2021, aim to enhance national digital security but have raised substantial concerns regarding their impact on media operations, freedom of expression, and privacy. Journalists, in particular, face heightened risks due to broad surveillance powers, vague definitions of cyber offenses, and the reintroduction of criminal defamation provisions. This article examines the key provisions of Zambia's cybersecurity laws, their implications for legal professionals advising media clients, and the ongoing challenges to digital rights and press freedom within the country's evolving regulatory landscape.

The digital age has brought forth an imperative for nations to fortify their cybersecurity frameworks, and Zambia is no exception. The Zambia Cyber Security Agency (ZCSA) has consistently urged journalists and legal professionals to familiarise themselves with the country's cybersecurity laws, particularly in periods of heightened public discourse such as general elections. While the initial call in 2021 was made in the context of the then-new Cyber Security and Cyber Crimes Act No. 2 of 2021, the legal landscape has since evolved significantly, with new legislation enacted in 2025.

This ongoing emphasis underscores the critical interface between national security, digital governance, and fundamental rights, especially freedom of expression and press freedom. For legal practitioners, understanding these laws is not merely a matter of compliance but a crucial aspect of safeguarding democratic principles and advising clients navigating an increasingly complex digital environment. This article will delve into Zambia's current cybersecurity legislation, highlighting its key provisions, the concerns it raises for journalists and media organisations, and the broader implications for digital rights in the country.

Zambia's journey towards a comprehensive cybersecurity legal framework has been marked by rapid legislative development. The initial significant step was the enactment of the Cyber Security and Cyber Crimes Act No. 2 of 2021 (CSCCA 2021) and the Electronic Communications and Transactions Act No. 4 of 2021 (ECTA 2021). The CSCCA 2021 was designed to provide for cybersecurity, protect against cybercrime, facilitate the identification and protection of critical information infrastructure, and enable the collection and preservation of electronic evidence. It introduced provisions addressing hate speech, intentional harassment, and unauthorised access or interception of data, with significant penalties.

However, the CSCCA 2021 faced considerable criticism from civil society and digital rights advocates for granting broad surveillance powers to law enforcement, vaguely defining cyber-related offenses, and potentially chilling legitimate journalistic inquiry. In response to these concerns and a stated aim to strengthen the digital security regime, the Zambian Parliament enacted the Cyber Security Act No. 3 of 2025 (CSA 2025) and the Cyber Crimes Act No. 4 of 2025 (CCA 2025) in April 2025, which repealed and replaced the CSCCA 2021. These new laws represent the current legal framework governing cybersecurity and cybercrime in Zambia, drawing a clearer distinction between regulatory and criminal law functions, but continuing to attract significant debate regarding their human rights implications.

The Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025, while ostensibly aimed at combating cyber threats, contain several provisions that pose tangible risks to press freedom and freedom of expression in Zambia. A primary concern for journalists is the reintroduction of criminal defamation within the CCA 2025. This Act punishes false statements that damage someone's reputation, effectively criminalising online defamation. This move is particularly contentious as it reverses earlier progress made by President Hichilema's administration in repealing Section 69 of the Penal Code, which criminalised defamation of the president.

Furthermore, the CCA 2025 includes broadly worded and vague definitions of offenses that could be weaponised against dissenting voices. For instance, Section 22 criminalises the publication of anything “obscene, vulgar, [or] lewd” with intent to humiliate or harass, and online communication that causes “emotional distress.” Such subjective terms grant law enforcement wide discretion, enabling them to target journalists, opposition members, and civil society activists, thereby suppressing legitimate online discourse and discouraging whistleblowing. Section 44 of the CCA also penalises the unauthorised disclosure of “critical information” without adequately defining what constitutes such information or providing public interest exemptions, which could severely impede investigative journalism.

The CSA 2025, on its part, grants extensive surveillance powers to authorities. Section 22 allows for real-time interception of communications without sufficient procedural checks or warrants, and the Zambia Cyber Security Agency (ZCSA) can conduct intrusive information security audits on entities controlling “critical information” or operating in “critical sectors” such as the public sector and information and communications technology. The ZCSA's placement under the direct control of the President further raises concerns about its independence and the potential for political interference and abuse of these powers, particularly in the run-up to elections. The requirement for data localisation, mandating that “critical information” be stored within Zambia, also increases the risk of government monitoring of private information.

These legislative developments have been met with strong disapproval from local and international civil society organisations, who argue that the laws lack adequate human rights safeguards and create a chilling effect on freedom of expression and access to information. The absence of clear mandates for authorities to exercise restraint or for courts to interpret the laws in a manner that respects free speech and privacy rights leaves citizens with weaker legal protections against potential abuse. The Law Association of Zambia has indicated its intention to challenge certain provisions of the new laws in court, reflecting the significant constitutional concerns they raise.

The Zambian government's efforts to enhance cybersecurity through the Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025 present a double-edged sword. While acknowledging the legitimate need to combat cybercrime and protect critical infrastructure, the current legislative framework introduces significant challenges to fundamental rights, particularly for journalists and media practitioners. The broad surveillance powers, vague definitions of offenses, and the re-criminalisation of defamation create an environment conducive to self-censorship and the suppression of critical reporting, which is vital for a healthy democracy.

Legal practitioners advising media organisations, civil society, and individuals must remain acutely aware of these laws and their potential for misuse. It is imperative to advocate for judicial interpretations that uphold constitutional protections for freedom of expression and privacy, and to challenge provisions that unduly restrict digital rights. The ongoing legal challenges and the vigilance of civil society will be crucial in shaping how these laws are applied in practice, and whether Zambia can achieve digital security without compromising its democratic freedoms. Practitioners should closely monitor any statutory instruments, judicial pronouncements, and enforcement actions by the ZCSA to provide timely and effective counsel to their clients.