Malawi

Data Protection Act, 2024 IN FORCE

commenced assented 2024-01-31; published 2024-02-02; commenced 2024-06-03 (GN 40/2024) · Official full text ↗

Scope

Personal data processing (automated or not) by controllers and processors based in Malawi, processing within Malawi, or targeting individuals in Malawi (s. 3); replaces Part IV of the Electronic Transactions and Cybersecurity Act 2016 as the primary DP regime.

Key obligations

Lawful bases incl. consent, contract, legal obligation, vital interest, public interest and legitimate interest (s. 8), with full processing principles (ss. 8-13); Records of processing activities open to MACRA inspection (s. 29); DPIAs for high-risk processing submitted to MACRA before processing (s. 30); Mandatory registration of significant controllers/processors: those processing data of more than 10,000 subjects or data of national importance (ss. 41-42); Parental/guardian consent with age-verification mechanisms for children's data (s. 17); data subject rights incl. portability, erasure and restriction (ss. 19-26)

DPO required

Yes for large-scale processing: organisations engaged in large-scale data processing must appoint a DPO (s. 33).

Registration

Yes for significant controllers/processors (>10,000 data subjects or data of national importance): register with MACRA before processing (ss. 41-42); MACRA's Data Protection Handbook details the process.

Cross-border transfers

Transfers outside Malawi only where the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism affording adequate protection (s. 38(1)(a), assessed per s. 39(2)-(3)), or under a s. 39(4) derogation (informed consent, contract performance/pre-contractual measures, contract in the data subject's interest, or transfer for the data subject's benefit where consent is impracticable). The Minister may designate adequate countries/sectors/standard clauses by Gazette notice (s. 39(5)); adopted BCRs/codes/certifications must be submitted to the authority (s. 40); a record of the transfer basis must be kept (s. 38(2)). No general prior-authorization requirement and no data-localization mandate. Verified against the archived Act text 2026-07-11.

Breach notification

Notify MACRA within 72 hours of a breach; affected data subjects must also be notified within 72 hours where the breach poses a high risk to their rights (ss. 36-37).

Penalties

Administrative penalties of up to MWK 20,000,000 via MACRA compliance orders, which can also order compensation and disgorgement of profits (s. 45(2)); non-compliance with a compliance order is an offence - fine of MWK 10,000,000 plus 2 years' imprisonment for a natural person, MWK 50,000,000 for a legal person (s. 45(4)); obstruction of the authority: MWK 10,000,000 plus 2 years (s. 48); breach of confidentiality: MWK 20,000,000 plus 5 years (s. 49); regulations may create offences up to MWK 5,000,000 plus 12 months (s. 52(3)). All quanta verified against the archived Act text 2026-07-11.

Authority

Malawi Communications Regulatory Authority (MACRA), operating the Malawi Data Protection Authority (dpa.mw)

Verified 2026-07-11

Access to Information Act 2017 IN FORCE