Servers in country
Providers with exit locations in Zambia: a server here gives you an address in the country. The register’s table records no mandate for VPN operators here; the briefing below sets out what the law asks of providers.
Only a few providers publish an exit here.
Providers with exit locations in a country — a fact about a network, kept deliberately apart from where the company is registered. Only providers whose country list has a source appear: a provider that publishes nothing simply does not show up, which is a criterion already in the data rather than an editorial one.
Under Zambia’s Cyber Security Act, 2025 every interception passes through the Central Monitoring and Coordination Centre, a state facility, and licensed electronic communications providers must install the equipment for it at their own expense. A judge’s order is required, though an officer may orally ask a provider to intercept where life, bodily safety or property is at risk.
The Cyber Security Act, 2025 (Act No. 3 of 2025, in force from 12 May 2025) binds every electronic communications service provider, meaning a person licensed under the Information and Communication Technologies Act, 2009. Such a provider must support real-time interception, install the equipment at its own expense and pass intercepted traffic to the Centre, on pain of a fine (ss. 39–40).
Section 40(1)(b) also requires it to store call-related information or internet connection records; the Act sets no period and leaves the manner to regulations the President may make. Whether a VPN operator holds a licence under the 2009 Act, and so falls within these duties, is not established.
The Cyber Crimes Act, 2025 (No. 4) lets an officer require preservation of data for up to seven days (s. 30) and a judge order a person in control of traffic data to collect it (s. 32). Human Rights Watch reports that in July 2025 the Law Association of Zambia petitioned the High Court to declare provisions of the Cyber Crimes Act unconstitutional.
Neither Act provides for blocking sites. Content is restricted by criminal offence: the Cyber Crimes Act punishes child pornography (s. 15) and using a computer to incite ethnic divisions among the people of Zambia (s. 24(1)(b)), the latter, with the other terrorism-related acts in that subsection, by life imprisonment.
Section 22 of the Cyber Crimes Act makes it an offence to publish indecent or obscene data with intent to humiliate or harass, and to disseminate information or an image knowing it to be false where it damages a person’s reputation or exposes them to public ridicule, contempt, hatred or embarrassment. The penalty is a fine of up to 200,000 penalty units, up to two years, or both.
A person who receives an investigation order commits an offence by disclosing that it exists (s. 21). An account is traced through providers: an officer with a warrant may require traffic data identifying a provider or the path of a communication (s. 31), and a judge may order its collection (s. 32).
Interception requires an ex parte application to a judge (Cyber Security Act s. 29), though an officer may orally ask a provider to intercept where life, bodily safety or property is at risk (s. 30). Every interception passes through the Centre, which is run by the division responsible for Government communications (s. 21).
The order of the rows is the security score, and a server’s location is not a recommendation.
Zambia
Only a provider that publishes a country list appears here at all — 41 of the 77 on file. The other 27 are not missing research: they publish no list, and U02_server_countries is unknown for them rather than filled from the number their marketing claims.
A provider that says “100+ countries” and enumerates none gets no page on any of them, and the count printed on its own record is the length of the list, never the claim. With 41 providers behind 180 countries, the long tail of these pages carries one or two rows.
More countries
Coverage149countries
Paying monthly$14.99monthly
Paying yearly$139.08yearly total
Free tierNopaid plans only
Devices10at once
Security
Usability
Coverage168countries
Paying monthly$11.99monthly
Paying yearly$47.84yearly total
Free tierYeslimited free plan
Devices5at once
Security
Usability
What moved
Every row is the record’s own history[], filtered to U02_server_countries and P04_mandate_response; the whole log holds every field.
29 Aug 20261 changes
NordVPNResponse to a national logging mandateP04_mandate_response
not on the record changed to withdrew_physical
