Privacy & Data Protection Policy
Statutory disclosure on the processing of personal and professional data under the Data Protection Act and the Estate Agents Act.
1. Regulatory Data Mandate
1.1 Legal Basis for Processing
As a statutory regulator, ZIEA processes personal data primarily to fulfill its legal obligations under the Estate Agents Act No. 21 of 2000. All processing activities are conducted in strict compliance with the Data Protection Act No. 4 of 2021.
1.2 Data Controller
The Zambia Institute of Estate Agents (Council) is the Data Controller for all information collected via this portal. The Registrar acts as the primary custodian of the official Register.
2. Categorization of Data Collected
2.1 Member and Practitioner Data
2.1.1 Statutory Identity Data
National Registration Card (NRC) numbers, Passport data, TPINs, and biometric data (fingerprints) provided for police clearance.
2.1.2 Professional Pedigree
Academic transcripts, degree certificates, previous employment history, and letters of reference from ZIEA members in good standing.
2.1.3 Compliance Records
Continuous Professional Development (CPD) logs, attendance certificates for ZIEA short courses (Level 1 & 2), and mentorship reports for Associate members.
2.2 Firm and Agency Data
2.2.1 Operational Data
Firm physical address (Fixed Abode), list of directors/partners, and professional indemnity insurance policy details.
2.2.2 Financial Oversight Data
Trust account bank details, annual audit reports, and statutory contribution records for the Compensation Fund.
3. Statutory Purposes of Data Processing
The Institute processes your data for specific regulatory mandates:
- Public Registry Maintenance: Publishing the official list of licensed agents (Section 15) to protect the public from "briefcase" agents and unregulated land dealers.
- Professional Investigation: Conducting inquiries into professional misconduct via the Disciplinary Committee. This includes processing complaint evidence and hearing transcripts.
- Financial Integrity: Verifying trust account compliance and managing payouts from the Estate Agents Compensation Fund.
- AML/CFT Compliance: Facilitating the identification of suspicious transactions and politically exposed persons (PEPs) in collaboration with the Financial Intelligence Centre.
4. Data Sharing and Third-Party Disclosures
Under Section 22 of the Data Protection Act, ZIEA may disclose data without consent for:
Government Agencies
Zambia Police Service, Anti-Corruption Commission (ACC), and Drug Enforcement Commission (DEC) for crime prevention.
FIC Zambia
Submission of STRs and CTRs as required for all DNFBPs under the FIC Act.
Public Record
Publication in the Government Gazette and the official ZIEA online directory.
5. Data Retention and Regulatory Archiving
ZIEA maintains a dual-track retention policy:
5.1 Active Records
Registration and financial records are kept for the duration of membership plus a statutory 10-year period following cessation of practice.
5.2 Permanent Archive
Records of disciplinary sanctions, license revocations, and registration history are maintained in a permanent regulatory archive. This is necessary to prevent re-registration of struck-off practitioners and maintain the integrity of the profession.
6. Security Infrastructure
We implement a defense-in-depth strategy to protect regulatory data:
- Role-Based Access Control (RBAC): Access to sensitive member files is restricted to authorized Secretariat staff.
- Audit Trails: Every access, modification, or export of practitioner data is logged and reviewed.
- Encryption: AES-256 encryption for data at rest and TLS 1.3 for all portal communications.
7. Rights of Data Subjects
Pursuant to the Data Protection Act No. 4 of 2021, you may exercise your rights of Access, Rectification, and Portability by contacting the Data Protection Officer at the ZIEA Secretariat.
Registrar & Data Protection Officer
ZIEA Secretariat | Premium House, 3rd Floor, Lusaka
Email: [email protected]
You have the right to lodge a complaint with the Data Protection Commissioner of Zambia should you feel these standards have been breached.