Introduction
The National Pension Scheme Authority (NAPSA) is committed to protecting the privacy, confidentiality, and security of the Personal Data entrusted to us by our members, pensioners, beneficiaries, employers, service providers, and other stakeholders.
As the institution responsible for administering Zambia's national pension scheme, NAPSA processes significant volumes of Personal Data while fulfilling its statutory functions. We recognise that Personal Data belongs to the individual to whom it relates, and we are committed to handling such information responsibly, transparently, and in accordance with the Data Protection Act No. 3 of 2021, recognised data protection principles, and other applicable laws.
This Privacy Notice explains how we collect, use, store, share, secure, retain, and otherwise process Personal Data. It also explains the rights available to Data Subjects and the measures NAPSA has implemented to ensure that Personal Data is processed lawfully, fairly, and securely in accordance with the Data Protection Act and any other applicable legislation.
By engaging with NAPSA, using our services, accessing our digital platforms, submitting claims, making contributions, participating in our investment and social security programmes, or otherwise interacting with us, you acknowledge that your Personal Data may be processed in accordance with this Privacy Notice.
Who We Are
The National Pension Scheme Authority is a statutory body established under the National Pension Scheme Act No. 72 of 2026 for the administration of Zambia's national pension scheme. As part of this mandate, NAPSA is responsible for registering members and employers, collecting and managing pension contributions, processing and paying benefits, safeguarding pension assets, conducting compliance activities, and providing social security services to members and beneficiaries.
To effectively perform these functions, NAPSA regularly processes Personal Data relating to contributors, pensioners, employers, dependants, beneficiaries, service providers, visitors, and other stakeholders.
For purposes of data protection legislation, NAPSA may act as a Data Controller when determining how and why Personal Data is processed and, in certain circumstances, as a Data Processor when processing Personal Data on behalf of another party in accordance with applicable law.
Who Does This Privacy Notice Apply To?
This Privacy Notice applies to all individuals whose Personal Data is processed by NAPSA in connection with its functions, operations, services, websites, applications, and systems.
This includes current, prospective, and former members of the National Pension Scheme, pensioners receiving benefits from the Authority, dependants and beneficiaries entitled to benefits under the Scheme, employers registered with NAPSA, and individuals representing such employers.
It also applies to suppliers, contractors, consultants, service providers, agents, and other business partners who provide services to NAPSA or interact with the Authority in the course of business. Additionally, this Notice applies to users of NAPSA's websites, mobile applications, digital services, customer service channels, social media platforms, physical premises, and any other individuals whose Personal Data may be collected or otherwise processed by NAPSA.
This Notice does not replace any specific privacy information that may be provided in relation to a particular NAPSA product, service, programme, or activity. Where a more specific privacy notice applies, it shall take precedence in relation to that activity.
Important Terms You Need to Understand
Personal Data
Personal Data refers to any information relating to an identified or identifiable natural person. An identifiable individual is one who can be identified directly or indirectly through reference to information such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
For purposes of NAPSA's operations, Personal Data may include information such as an individual's name, National Registration Card number, passport number, NAPSA membership number, contact details, employment records, salary information, pension contribution records, banking details, benefit records, photographs, biometric information, and any other information capable of identifying the individual.
Sensitive Personal Data
Some categories of Personal Data require a higher level of protection because their misuse may expose an individual to discrimination, financial harm, reputational damage, or other risks.
Sensitive Personal Data includes information relating to an individual's health, disability status, biometric information, ethnic origin, religious beliefs, political opinions, trade union membership, criminal convictions, genetic information, and other categories of information protected under applicable data protection laws.
NAPSA will only process Sensitive Personal Data where permitted by law and where adequate safeguards have been implemented to protect the rights and freedoms of the Data Subject.
Processing
Processing refers to any operation performed on Personal Data whether by automated or non-automated means. This includes collecting, receiving, recording, organizing, structuring, storing, retrieving, consulting, using, adapting, sharing, transmitting, restricting, archiving, deleting, or destroying Personal Data.
Virtually every interaction involving Personal Data may constitute processing. Accordingly, whenever NAPSA receives information from a member, accesses a contribution record, verifies an identity document, processes a pension benefit, stores documents electronically, or shares information with an authorised third party, Personal Data is being processed.
What Personal Data Does NAPSA Collect?
The type of Personal Data NAPSA collects depends on the nature of the relationship between the individual and the Authority, the services being provided, and the legal obligations applicable to NAPSA.
In administering the National Pension Scheme and carrying out its operational activities, NAPSA may collect identifying information such as names, national registration numbers, gender, nationality, dates of birth, photographs, signatures, and marital status information.
We may collect contact information including physical addresses, postal addresses, email addresses, mobile telephone numbers, and other communication details to facilitate ongoing engagement with members, employers, pensioners, and beneficiaries.
Where necessary for pension administration, NAPSA may collect employment-related information including employer details, salary information, employment history, contribution histories, payroll records, appointment details, and related employment documentation.
To facilitate payment of contributions and benefits, we may process financial information such as bank account details, mobile money account information, payment records, contribution information, tax-related information, and other financial identifiers required to administer transactions.
NAPSA may also process information relating to dependants, beneficiaries, nominees, legal guardians, executors of estates, and next of kin where such information is necessary to determine eligibility for benefits or to facilitate the administration of claims.
In certain circumstances, NAPSA may process biometric information including facial images, fingerprints, or other verification data for identity verification, security management, access control, fraud prevention, and compliance purposes.
When individuals access our websites, digital platforms, self-service portals, or mobile applications, we may collect technical information such as Internet Protocol (IP) addresses, operating system information, browser details, device identifiers, login records, access timestamps, and usage data to improve services, maintain security, and support system administration.
For security purposes, NAPSA may utilize closed-circuit television (CCTV) systems and visitor management systems at its premises. Accordingly, images, recordings, access logs, and visitor information may be collected and processed to protect our facilities, employees, members, assets, and information systems.
Changes to privacy policy
NAPSA may update this Privacy Notice periodically to reflect changes in our privacy practices, legal requirements, or operational processes. Where updates are made, we will revise the effective date of this Notice and, where the changes materially affect you, communicate them through an appropriate channel based on how we ordinarily engage with you.
If you have any questions about our processing of your personal data or would like to access your personal data or other requests, please contact us at:
Data Protection Office
National Pension Scheme Authority
E-mail: info@napsa.co.zm
Address: NAPSA House, Corner of Cairo Road and Church Road, P.O. Box 51275, Lusaka, Zambia.
For complaints, you may also contact:
Data Protection Commissioner
Maxwell House, Los Angeles Boulevard,
P. O. Box 50464, Lusaka, Zambia.
Website: www.dataprotection.gov.zm
We will address your concerns in accordance with NAPSA’s Data Protection and Privacy Policy, applicable law and international best practice relating to Data Protection.
