When Zambia enacted the Data Protection Act, many organizations immediately focused on compliance.
What forms do we need to submit?
What policies do we need to develop?
What does the regulator expect?
What are the penalties for non-compliance?
Those are fair questions, and they are important questions.
Having now been directly involved in leading our data protection compliance journey within an international non-profit organization, I have come to believe that the Act is far bigger than compliance.
For me, it has been a lesson in governance, collaboration, accountability, and organizational maturity.
And perhaps most importantly, it has reminded me that behind every dataset is a human being who has trusted us with their information.
Compliance Is Not a Solo Activity
One of my earliest realizations was that no single department can deliver data protection compliance alone.
As technology professionals, it is easy to assume that data protection sits within IT.
As risk professionals, it is easy to assume it belongs to compliance.
As leaders, it is tempting to assign ownership to a Data Protection Officer and consider the matter addressed.
The reality is very different.
In our case, achieving meaningful progress required collaboration across multiple departments and multiple levels of the organization.
Programs teams understood how information was collected in communities.
Human Resources understood employee data.
Finance managed sensitive financial information.
Sponsorship teams handled beneficiary records.
Technology teams understood systems, infrastructure, and security controls.
Senior leadership provided governance, direction, and resources.
Beyond the country office, we also relied heavily on support from regional and global colleagues who helped align local regulatory expectations with enterprise standards and practices.
The compliance journey quickly became an organizational journey.
And that, in my view, is exactly how it should be.
Data Mapping Opened Our Eyes
One of the most valuable activities during the process was data mapping.
On paper, data mapping sounds straightforward.
You identify what data you collect, where it comes from, where it goes, and who has access to it.
In practice, it tells a much richer story.
It reveals how work actually happens.
You discover processes that have evolved over time.
You find duplicate data collection.
You identify information being stored in multiple places.
You uncover workarounds that staff created years ago to solve operational challenges.
Some of these discoveries have nothing to do with privacy and everything to do with process improvement.
As someone passionate about continuous improvement and transformation, I found this particularly interesting.
The exercise challenged us to ask:
Why are we collecting this information in the first place?
That question alone can transform an organization.
Good Data Protection Starts With Good Governance
The biggest lesson I have taken from the Act is that data protection is fundamentally a governance issue.
Technology is important.
Policies are important.
Training is important.
But before any of these things can succeed, organizations must answer several governance questions:
- Who owns the data?
- Who approves access?
- Who determines retention periods?
- Who is accountable for quality?
- Who decides what is necessary to collect?
- Who monitors compliance?
These are not technology decisions.
They are leadership decisions.
The Data Protection Act has encouraged many organizations, including ours, to rethink how information is governed and how accountability is assigned.
That is a healthy outcome.
The Human Side of Data Protection
Working in the non-profit sector gives data protection a deeper meaning.
We do not simply manage records.
We work with children.
We work with families.
We work with vulnerable communities.
We work with employees, partners, volunteers, and donors.
Many of the individuals whose information we hold have trusted us with deeply personal details of their lives.
When viewed from that perspective, data protection stops being a compliance discussion.
It becomes a trust discussion.
Every time an organization loses sight of the human being behind the data, privacy becomes a technical exercise.
Every time an organization remembers the human being behind the data, privacy becomes a responsibility.
DPIAs Became More Than Risk Assessments
One of the most fascinating parts of our journey was conducting Data Protection Impact Assessments (DPIAs).
Initially, I saw them as a mechanism for identifying privacy risks.
What I discovered was that they were also an excellent tool for understanding how the organization functioned.
DPIAs forced us to examine processes, challenge assumptions, evaluate controls, and revisit longstanding practices.
In many cases, the outcome was not simply stronger privacy controls.
The outcome was better governance, clearer accountability, and improved operational processes.
That was an unexpected benefit.
Compliance Should Lead to Maturity
Too often organizations view compliance as a project with a finish line.
Develop policies.
Conduct training.
Submit documentation.
Close the project.
Move on.
I believe that mindset misses the opportunity.
The real value lies in what happens after compliance.
Do departments continue to think about privacy when designing new processes?
Do managers consider data protection when making decisions?
Do project teams include privacy discussions early rather than at the end?
Do leaders continue asking governance questions?
When these behaviours become part of organizational culture, compliance evolves into maturity.