Malawi

DATA PROTECTION FACTSHEET

Achim1999, Public domain, via Wikimedia Commons

DATA PROTECTION LAW IN PLACE

DATA PROTECTION AUTHORITY APPOINTED

Download the Act

Fast Facts
Domestic Law
Privacy enshrined in Constitution: Yes, privacy is protected in Section 21 of the Constitution.

DPA legislation: Malawi enacted the Data Protection Act in 2024, with the communication regulator MACRA designated as the data protection authority.

Previously, the Electronic Transactions and Cybersecurity Act No. 33 of 2016 also replicated some provisions seen in data protection laws.

Under Act No. 33 of 2016, individuals have the right to:

obtain all of their personal data in an understandable form, as well as any available information as to the origin;

oppose, for legitimate reasons, the processing of personal data concerning them;

object to the processing of their personal data for prospecting purposes; and

rectify or erase personal data concerning them where it is inaccurate, incomplete, equivocal, out of date, or if collection, use, communication or conservation is prohibited.
International Commitments
Scope of Application

Applies to natural persons: Yes

Applies to juristic persons: Yes

Applies to public entities: Yes

Domestic/personal purposes exclusion: No

National security exclusion: No

Law enforcement exclusion: No

Cabinet or Executive Council exclusion: No

Judicial functions exclusion: No

Journalistic, literary or artistic purposes exclusion: No

Temporary copies exclusion: No

Other exclusion(s): No

Broad or vague exclusions: No

Applies to foreign entities: No

Excludes foreign entities that only transit personal data through the country: No
Personal Data
Under Act No. 33 of 2016, personal data means any information relating to an individual who:

may be directly identified; or

if not directly identified, may be identifiable by reference to an identification number or one or several elements related to his physical, physiological, genetic, psychological, cultural, social, or economic identity.
Collection and Processing
Personal data processing may only occur with consent from the data subject or if processing is necessary for:

compliance with a legal obligation to which the controller is subject;

the performance of a public interest mission or the exercise of public authority;

the commencement or performance of a contract in the data subject’s interests or to which he, she or they are a party;

safeguarding the interests or fundamental rights and freedoms of the data subject; or

the pursuit of legitimate interests of the controller or third-party data processor, provided these interests preserve the fundamental rights and freedoms of the data subject.

Personal data must be:

processed fairly and legally;

collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;

adequate, relevant, and not excessive in relation to the purposes for which they are collected and processed;

accurate and kept up to date, where necessary; and

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data was collected or for which it is further processed.
Transparency

Notification that data is being processed: Yes

Notification to DPA in event of data breach: No

Notification to data subject in event of data breach: No

Timeframe for notification is specified: NA

Exceptions exist to breach notifications: NA

Requires a data processing register: No

Register is publicly available: NA

Provides for terms of service icons: No

DPA must submit at least annual report: No

DPA report is made public: NA
Accountability

Explicit provision for civil liability: No

Established/designates a Data Protection Authority: Yes: MACRA, the communication regulator, is designated.

DPA is empowered to investigate: Unclear

DPA is empowered to subpoena or request evidence: Unclear

Law provides for criminal penalties: Yes

Law provides for administrative penalties: No

DPA is independently structured (does not exist within or receive instructions from another public body): Unclear

DPA receives funding directly from the state budget/legislative body: Unclear

DPA may receive some forms of external funding/own revenue: Unclear

Adequate protections against undue removal: Unclear

Number of members in DPA: Unclear

Maximum term length for members of the DPA (years): Unclear
Participation

Right of data subject to access a copy of their personal data: Yes

Right of data subject to request a correction of data: Yes

Right of data subject to request deletion of data: Yes

Justification required for a request for deletion: Yes

Defines the requirements for consent: Yes

DPA is mandated to participate in policy formulation: No
Cross-border Transfer
Automated Processing

LEARN MORE ABOUT THE METHODOLOGY

Page last updated: 28 January 2026.