Malawi Has a Data Protection Law. Compliance Now Has a Regulator.
Malawi’s Data Protection Act No. 3 of 2024 moved privacy compliance onto a statutory foundation and designated a national authority to supervise it. The important change is that data governance now has an enforcement path.
The Act was assented to on 31 January 2024 and published on 2 February. It establishes processing principles, individual rights, security duties, breach requirements and rules for international transfers. The Malawi Communications Regulatory Authority was designated to perform the data protection authority role.
That combination matters. A privacy law without a regulator can remain largely contractual. Malawi’s framework gives complaints, investigations, corrective action and public accountability an institutional home.
Processing must be explainable
The Act requires personal data to be processed lawfully and fairly, for defined purposes, in a proportionate way and with appropriate accuracy, retention and security controls. It also creates specific rules for sensitive data, children and people who cannot legally provide consent themselves.
Organisations should be able to connect every material data set to a purpose, legal basis, retention period and accountable owner. If that explanation exists only in legal wording that does not match the system, it will fail during an incident or complaint.
Large-scale processing needs governance
The Act provides for data protection officers in the circumstances it covers, including large-scale processing. The DPO function should be independent enough to challenge a project and close enough to engineering to understand what is actually deployed.
Processor contracts also need to define instructions, security, confidentiality, deletion, assistance with rights and incident escalation. The controller remains accountable for the processing it chooses to outsource.
Breach handling can become public
The Act establishes notification and communication duties for personal-data breaches. Notices must describe the nature of the breach, likely consequences and the measures taken or proposed.
Where individual communication would involve disproportionate effort or expense, the controller may need a public notification. The authority can also make a public notification if it considers the controller’s measures inadequate. This turns incident communications into a governance control, not a late public-relations choice.
International transfers need a recorded basis
Transfers outside Malawi are restricted unless the recipient is subject to adequate protection through law, binding corporate rules, contractual clauses, a code of conduct, certification or another statutory condition. Controllers and processors must keep a record of the basis used.
This requires a real transfer inventory. Overseas hosting, remote support, identity services, email security, analytics and disaster recovery may all create transfers even when the main business application remains in Malawi.
What organisations should do now
- Map personal data, purposes, legal bases, retention and system owners.
- Determine whether a data protection officer is required and define the role.
- Update controller, processor and subprocessor contracts.
- Document the legal and technical basis for every international transfer.
- Test breach triage, authority notification and data-subject communication.
- Monitor the authority’s guidelines rather than relying on static launch-day advice.
A regulator changes the evidence standard
The mature response is not to copy a foreign privacy programme and rename it. Malawi’s authority, transfer rules, breach process and statutory definitions need to appear in the organisation’s control map. The programme should be able to show what happens, not only what policy says should happen.
Official sources
- Government of Malawi: Data Protection Act 2024
- Malawi Data Protection Authority: guidance and downloads
This article provides general information and is not legal advice.
Continue the series: Africa Cyber & Digital Law Series index
