Data protection in Malawi.

The Data Protection Act, 2024 (Act 3 of 2024) is Malawi's first comprehensive data protection law. It was published in February 2024 and came into force on 3 June 2024. The Malawi Communications Regulatory Authority (MACRA) is the designated data protection authority.

Get started Check your readiness

In force: June 2024
Regulator: MACRA
Admin penalty: Up to MWK 20M

Supported via Kenya Hub

Lilongwe

At a glance

Malawi, in seven lines.

Law: Data Protection Act, 2024 (Act 3 of 2024)
In force: 3 June 2024
Regulator: Malawi Communications Regulatory Authority (MACRA)
Registration: Controllers and processors of significant importance register with MACRA: those handling data on more than 10,000 people, or data of national significance
Data protection officer: Required for public authorities, and where core activities involve large-scale monitoring or sensitive data (section 33)
Breach notification: Within 72 hours to MACRA (sections 36 and 37)
Penalties: Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to five years' imprisonment

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in Malawi meet first, and where we help with each.

Register if you are of significant importance

Controllers and processors handling the data of more than 10,000 people in Malawi, or data of significance to the economy, society or security, register with MACRA. Others had a 24-month grace period.

DPO360 helps with

Registration and licensing filings with national data protection authorities

Appoint a DPO where required

Required for public authorities other than courts, and where core activities involve large-scale monitoring or sensitive data.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Report breaches within 72 hours

Controllers notify MACRA within 72 hours of becoming aware, and communicate serious breaches to data subjects.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Assess impact before you start

A data protection impact assessment report is submitted to MACRA before certain processing begins.

DPO360 helps with

Data Protection Impact Assessments (DPIAs) for new or high-risk processing

How the framework came together

From the law to the regulator.

2 February 2024
The Act is published
The Data Protection Act, 2024 is published, replacing the data protection provisions of the Electronic Transactions and Cyber Security Act, 2016.
3 June 2024
The Act comes into force
MACRA becomes the designated data protection authority.
After commencement
MACRA publishes guidance
MACRA publishes a Data Protection Handbook to guide compliance.

MACRA

Regulatory authority

Malawi Communications Regulatory Authority (MACRA)

Designated by the Act as Malawi's data protection authority, with power to investigate potential or actual violations.

Mayamiko Nkoloma, Acting Director General

Visit the website

What the MACRA does

Registers significant controllers
Controllers and processors of significant importance register with MACRA.
Receives breach notifications
Breaches are notified to MACRA within 72 hours.
Investigates and enforces
Investigates potential or actual violations of the Act.

Penalties

What non-compliance can cost.

Administrative penalties

MWK 20M

up to, administrative penalty

MACRA can order a controller or processor to pay an administrative penalty of up to MWK 20 million, alongside other compliance orders.

Ignoring an order

5 yrs

imprisonment, plus a MWK 20M fine

Failing to comply with a compliance order is an offence, with a fine of MWK 20 million and imprisonment for five years. Directors who knowingly authorise an offence can be convicted too.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in Malawi, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

We know whether we are of significant importance.This decides registration with MACRA.
We have assessed whether a DPO is required.Public authorities and large-scale processors need one.
We can notify MACRA within 72 hours of a breach.Serious breaches also reach data subjects.
Transfers abroad go to places with adequate protection.MACRA assesses adequacy.
We run impact assessments before high-risk processing.Reports go to MACRA before processing starts.
Our policies and records of processing are documented.Documentation makes every other item easier to evidence.

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.


Law	Protection of Personal Information Act (POPIA)	Data Protection Act, 2019	Nigeria Data Protection Act (NDPA), 2023	Data Protection and Privacy Act, 2019	Personal Data Protection Act, 2022	Law No. 058/2021	Data Protection Act, 2021	Data Protection Act, 2024
In force	July 2021 (most provisions from July 2020)	November 2019	June 2023	May 2019 (regulations March 2021)	May 2023	October 2021 (full compliance October 2023)	April 2021	June 2024
Regulator	Information Regulator	Office of the Data Protection Commissioner (ODPC)	Nigeria Data Protection Commission (NDPC)	Personal Data Protection Office (PDPO)	Personal Data Protection Commission (PDPC)	National Cyber Security Authority (NCSA)	Office of the Data Protection Commissioner	Malawi Communications Regulatory Authority (MACRA)
Registration	Register your Information Officer with the Regulator	Mandatory above thresholds, and in certain sectors, with the ODPC	Controllers and processors of major importance register with the NDPC	Every data collector, processor and controller registers with the PDPO	Collectors and processors register with the PDPC	Controllers and processors register with the NCSA	No one may act as a controller or processor without registering	Controllers and processors of significant importance register with MACRA
Data protection officer	Information Officer required for every organisation	May be designated; relevant for public bodies, large-scale monitoring and sensitive data	Mandatory for controllers of major importance	A DPO must be designated by the head of the institution	A DPO must be appointed	Required in certain cases (large-scale monitoring or sensitive data)	A DPO must be appointed, under the Commissioner's guidelines	Required for public authorities, and for large-scale monitoring or sensitive data
Breach notification	As soon as reasonably possible, to the Regulator and data subjects	Within 72 hours to the ODPC; data subjects within a reasonably practical period	Within 72 hours to the NDPC; data subjects immediately where high risk	Immediately, to the PDPO	Promptly, to the PDPC	Within 48 hours to the NCSA	Within 24 hours to the Commissioner; data subjects as soon as practicable	Within 72 hours to MACRA
Penalties	Administrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offences	Up to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 years	Major importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%	Up to about UGX 4.8 million and/or 10 years for listed offences	Penalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 years	Administrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnover	Corporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 years	Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
	Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Data Protection Act, 2024 (sections 33, 36, 37, 41, 42, 49 and 50).

Additional resources

Read the source documents.

Malawi Communications Regulatory AuthorityRegulator website Data Protection Act 2024Legislation

Supported through

Kenya Hub

East, Central & Southern Africa

DPO360 in Malawi

How we support organisations in Malawi.

Malawi is supported through our Kenya hub, which covers East, Central & Southern Africa, with delivery coordinated from our Nairobi headquarters.

Registration and licensing filings with the national authority
Breach logging, escalation and regulator notification
Consent, policy and records-of-processing frameworks
Data mapping, including where data is processed
Data subject access request management
A standing DPO appointment, with DPO-as-a-Service

2nd Floor 90 JGO, James Gichuru Road, Lavington

P.O Box 40583-00100 Nairobi, Kenya

+254735360360 | +447394407463

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in Malawi and beyond.

Book a consultation DPO-as-a-Service

Data protection in Malawi.

Malawi, in seven lines.

What the law asks of you.

Register if you are of significant importance

Appoint a DPO where required

Report breaches within 72 hours

Assess impact before you start

From the law to the regulator.

The Act is published

The Act comes into force

MACRA publishes guidance

Malawi Communications Regulatory Authority (MACRA)

Registers significant controllers

Receives breach notifications

Investigates and enforces

What non-compliance can cost.

Where do you stand?

Eight countries at a glance.

Read the source documents.

How we support organisations in Malawi.

Ready to Make Privacy Your Advantage?