Malawi

Malawi has recently moved from embedded to standalone data protection regulation. Its current instrument is the Data Protection Act, 2024 (Act No. 3 of 2024), gazetted in May 2024 and in force from 3 June 2024. The Act replaces the data protection provisions formerly contained in Part IV of the Electronic Transactions and Cyber Security Act 2016, marking a shift from rules embedded within a broader cyber-statute to a dedicated, comprehensive regime aligned with contemporary international standards. The Act applies to wholly or partly automated processing and to non-automated processing forming part of a filing system, covering public and private bodies in Malawi and organisations outside Malawi that process data relating to Malawian data subjects. It establishes the full set of principles (lawfulness, transparency, fairness, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality) and grants data subjects rights of access, rectification, erasure, restriction, portability, and objection to automated decision-making. Special categories, health, biometric, genetic, racial and ethnic origin, religious belief, trade union membership, and political opinions, attract enhanced safeguards. Controllers must register, implement appropriate security measures, and notify the authority and affected individuals within 72 hours of a high-risk breach. Enforcement is carried out by the Malawi Communications Regulatory Authority (MACRA), which is designated as the national data protection authority and is responsible for the register of controllers and processors, complaints, investigations, guidance, and administrative penalties. As with several regional peers, supervision sits within the communications regulator rather than a dedicated body. The 2016 framework it superseded may still warrant a separate historical record in the Library.