Privacy Map

Malawi. Comprehensive data protection. Act

Malawi DPAData Protection Act, 2024

In force
Partly verifiedMedium confidence. MACRA registration mechanism not launched as of the reviewed source.

§1Summary

Synopsis

Malawi's first comprehensive data protection law, designating MACRA as the data protection authority. It follows the GDPR/Kenya model with principles, rights, DPIA and breach obligations.

Key themes
  • registration of significant-importance entities
  • DPIA
  • breach notification
  • cross-border transfers
  • extraterritorial scope
Unique features

Controllers and processors 'of significant importance' (e.g. over 10,000 data subjects in Malawi) must register with MACRA and pay a fee. DPIA reports must be submitted to MACRA before high-risk processing.

SaaS relevance

Applies to non-Malawian providers offering online services to people in Malawi; larger SaaS platforms may need to register with MACRA.

§2Obligations

Extraterritorial
Yes
Breach notification
MACRA within 72h
DPO
Conditional
Cross-border transfers
Adequate law, BCRs, contractual clauses, codes, certification, consent; record basis
Maximum penalty
MWK 5m and/or 12 months' imprisonment per offence

§3Dates

Key dates
  • Adopted
  • In force
  • Gazetted February 2024; in force 2024-06-03; 2-year transition for ordinary controllers (to mid-2026)

§4Text and authority

Text
No authoritative text located.
Authority
Malawi Communications Regulatory Authority (MACRA)

§5Where it applies

Domestic law of
Malawi

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. MACRA registration mechanism not launched as of the reviewed source.