Protecting Your Personal Data in Online Registration: What VAZ Is Doing

Notice to Members · Data Protection

Lusaka, 1 October 2026

Dear Members,

Since the 2027 registration cycle moved online, several of you have asked how your personal data is protected, and whether the Association needed the approval of the Data Protection Commissioner before collecting it. These are fair questions, and you deserve a clear answer.

The Executive Committee has reviewed the online registration platform against every section of the Data Protection Act No. 3 of 2021. This notice sets out, plainly, what we found and what we are doing.

Registration continuesThe 2027 cycle is open. Practising without registration or a valid practising certificate is an offence under Act No. 45 of 2010.

No clearance was neededThe Act regulates how personal data is handled. It does not require the Commissioner’s approval for a registration function set by law.

Gaps are being closedWe found gaps that need fixing, and the work to close them has started. It does not require the process to stop.

What the law requires

The Act applies to the Association because we collect and keep your personal data: your name, NRC or passport number, contacts, photograph and qualifications. It requires us to register with the Office of the Data Protection Commissioner, to tell you clearly how your data is used, to keep it secure, to have written agreements with anyone who handles it for us, and to store it in Zambia.

It does not require us to obtain the Commissioner’s clearance or a waiver before carrying out registration, because registration is required by the Veterinary and Veterinary Para-Professions Act No. 45 of 2010.

What we found

Our review found four areas that need attention:

The registration forms did not include a privacy notice or a separate consent box.
The platform is currently hosted by a service provider outside Zambia. The Act requires personal data to be stored in Zambia unless an exception applies.
The written agreements the Act requires, with our platform developer and with the Veterinary Council of Zambia, were not yet in place.
The Association had not yet designated a Data Protection Officer.

We report these openly because you are entitled to know. None of them has led to any known loss or misuse of data. All of them can be fixed while registration continues.

What we are doing

Reviewed the online registration process against the Data Protection ActDone
Written to the Data Protection Commissioner for guidance, including on storage in ZambiaDone
Required the developer to confirm in writing where your data is stored and how it is securedDone
Published a Privacy Notice explaining how your data is used and your rightsDone
Replacing the single ‘agree to terms’ box with a clear, separate consent on all registration formsIn progress
Data Processing Agreement with the developer, Luminet Consulting LimitedIn progress
Joint-Controller Agreement with the Veterinary Council of ZambiaIn progress
Confirming the Association’s registration with the Office of the Data Protection CommissionerIn progress
Designated Dr. Simakechula Gelly Chikuni as Data Protection Officer, subject to ratification by the Executive CommitteeDone
Moving the platform’s data to a data centre in ZambiaPlanned

Your questions answered

Is my NRC number or date of birth published?

No. The public register shows only your name, index number, registration category and practising status. Your NRC or passport number, date of birth, private contacts and documents are never published.

Will my data be sold or given to sponsors?

No. VAZ never sells personal data and never gives it to sponsors, partners or advertisers.

Why ask for my gender?

Only to produce anonymised statistics about the profession. It is never published. The Executive Committee is considering adding a “Prefer not to say” option.

Can I refuse to give consent?

The consent box is required to complete registration. You may withdraw your consent at any time, but registration required by law cannot continue without the data it needs. The two optional boxes, a public directory listing and VAZ news, are entirely your choice.

Why not stop registration until everything is fixed?

Stopping would leave members unable to renew their practising certificates, and practising without one is an offence. None of the gaps requires the process to stop, so we are fixing them while registration continues.

What happens if there is a data breach?

The law requires us to notify the Data Protection Commissioner within 24 hours, and to tell affected members as soon as practicable. Our agreement with the developer will require them to tell us within 12 hours.

Your rights, and how to raise a concern

You have the right to see the data we hold about you, to have it corrected, to receive a copy, and in some cases to have it erased or its use restricted.

To use any of these rights, or to raise a concern, write to secretary@vaz.org.zm. We will respond within 30 days.

If you are not satisfied, you may complain to the Office of the Data Protection Commissioner under section 68 of the Act. This is your right, and you may use it at any time. The Association will co-operate fully with the Commissioner.

Full details are in the VAZ Privacy Notice for the registration platform.

Read the Privacy Notice →

Thank you for raising these questions. Members who hold us to a high standard make the Association stronger. We will update you as each step is completed.

Dr. Eugene C. BwalyaPresident, Veterinary Association of Zambia