Privacy & Data Rights
Company Shares Your Personal Details With Third Parties
A business passes your contact details to marketers or debt collectors without your consent
Premium
foundational
7 minutes
The Situation
What They Said
“We shared your details with our business partners — it's in our terms and conditions.”
Businesses sharing customer personal details — phone numbers, addresses, NRC copies — with affiliates, debt collectors, or marketing companies without clear informed consent is common in Zambia. The Data Protection Act 2021 requires that sharing of personal data with third parties have a lawful basis, typically explicit consent. A vague terms and conditions clause that the customer never saw or understood does not constitute valid consent for sharing sensitive personal data.
The Fallacy
Buried Consent Clause Fallacy
The company relies on a terms and conditions clause to justify data sharing, implying that your agreement to use the service was informed consent to share your data. This is legally questionable under the Data Protection Act. Consent for data sharing must be freely given, specific, informed, and unambiguous. A buried clause in a lengthy document that the average customer never reads does not satisfy the informed consent standard for sensitive data processing.
What the Law Says
Your Legal Foundation
Data Protection Act No. 3 of 2021
Section 13 — Consent Requirements
“Consent to the processing of personal data must be freely given, specific, informed, and unambiguous. A pre-ticked box or bundled consent for multiple purposes does not constitute valid consent.”
If the consent for data sharing was buried in general terms and not separately and clearly obtained, it may not be valid consent under the Act. You can withdraw consent and demand deletion of your data from the third parties.
Data Protection Act No. 3 of 2021
Section 28 — Right to Object
“A data subject has the right to object to the processing of their personal data, including for direct marketing purposes, and the data controller must cease such processing upon receiving the objection.”
You can formally object to your data being used for marketing. The company must stop. File with ZICTA if they continue.
Data Protection Act No. 3 of 2021
Section 29 — Right to Erasure
“A data subject has the right to request erasure of their personal data from the records of the data controller and any third parties to whom the data was disclosed.”
Request that the company delete your data from its records and from any third parties it was shared with. This is a legal right, not a courtesy they can refuse.
🔒
You Know the Law — But Do You Know What to Say?
Reading your rights is one thing. Using them under pressure — calmly, correctly, in the right words — is what actually protects you. Members get the scripted rebuttal for this exact situation: what to say first, what to say if they push back, the tone to use, and the constitutional provision to cite. Practise out loud with audio until it's automatic.
Unlock This Scenario — R89/month
Workers' Rights is free · All 10 domains from R89/month · Cancel anytime
Not ready to subscribe? Get the free checklist first.
10 real rights scenarios — what to say, what to cite, what to refuse. Free, no card needed.
What They'll Say Next
Common Counter-Arguments
After you respond, they may push back with these arguments. Members get the full rebuttal for each.
They might say: “ZICTA won't do anything — they are too busy with big cases.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
Know Your Rights. Know Your Word.
389 Zambian law and Scripture scenarios — exact rebuttals, constitutional law, and Scripture. Practise out loud with audio. Free to start.
Try Free — Workers' Rights
No credit card · Upgrade anytime for all 10 domains