SuloBaseKeeping data in Zambia
- The Act requires personal data to be processed and stored on a server or data centre located in Zambia s.70(1).
- Sensitive personal data must always be processed and stored in Zambia s.70(3). The Act's definition s.2 is wider than most people expect: it includes a person's sex, marital status, race and ethnic origin, health, religious beliefs, political opinions, trade-union membership, and genetic and biometric data. If your sign-up form asks for gender, you hold sensitive personal data.
- Sending personal data abroad needs the person's consent plus Commissioner-approved safeguards or a ministerial prescription, or the Commissioner's approval s.71.
On SuloBase: your databases, sign-in data and files are processed and stored on our server in Lusaka. Two things pass outside Zambia today: requests enter through Cloudflare's network, and on paid plans the encrypted off-site backup copy is held by Cloudflare R2. Every service that handles data is listed, with its location, on our subprocessors page.
What SuloBase covers
| Area | What we do | Act |
|---|---|---|
| Registration | Sulocorp Technologies is registered with the Data Protection Commissioner as a data controller and data processor, certificate DPC-DP000897, valid to 31 March 2027 | s.19 |
| Location | Databases, sign-in data and files in Lusaka. The encrypted off-site backup copy is outside Zambia today | s.70 |
| Separation between customers | Each project has its own database. Every platform change is automatically tested to confirm one customer's keys cannot reach another's project, and that row-level security holds | s.47(2)(c) |
| Security | TLS on all connections; backups test-restored and encrypted with AES-256; production access limited to named people; measures reviewed periodically | s.47 |
| Other processors | Listed, with where each runs, on our subprocessors page | s.52(1) and (2) |
| Breaches | We tell you as soon as practicable, and within 12 hours, so you can meet your 24-hour deadline to the Commissioner | s.49(1) and (2) |
| Your users' rights | Studio's table editor and sign-in pages let you find, correct and delete an individual's data, and the dashboard exports your whole project | ss.58 to 65 |
What your business must still do
SuloBase can't do these for you. Every business that handles personal data must:
- Register with the Data Protection Commissioner as a data controller before processing personal data s.19. Processing without registration is an offence. We'll give you the hosting and security facts the application form asks for.
- Appoint a data protection officer s.48.
- Keep a record of processing activities in the prescribed form s.45; Form XIII.
- Get valid consent: written, specific, informed and unambiguous, with the right to withdraw explained first s.2, s.15. Parents consent for children s.17.
- Tell people, when you collect their data, who you are, why, who receives it, and their rights s.64. Bring their rights to their attention in your first message to them s.61(5).
- Process sensitive data only as section 14 allows, and keep it in Zambia s.70(3).
- Notify the Commissioner within 24 hours of a breach affecting personal data, and the people affected as soon as practicable s.49.
- Answer rights requests: access, correction, erasure, objection, restriction, portability Part IX.
- Carry out an impact assessment before high-risk processing s.46; Form XIV.
- Expect an annual audit by the Commissioner or a licensed data auditor s.81.
Questions
tech@sulocorp.com. Customers can ask for our security measures, our subprocessor list, or the hosting facts for their registration form.
This page is general information about the Act, not legal advice.