Cybersecurity law & regulation in Malawi (2026)
Cybersecurity in Malawi: comprehensive law.
Malawi's primary cybersecurity instrument is the Electronic Transactions and Cyber Security Act 2016, which criminalises a broad range of cyber offences, gives legal effect to electronic transactions, and establishes the national CERT (mwCERT) under MACRA. The Data Protection Act 2024 (commenced May 2024) layers mandatory 72-hour breach-notification duties on top of that framework and designates MACRA as the data-protection authority. A National Cybersecurity Strategy (adopted c. 2019-2020) sets objectives for critical-information-infrastructure protection and guides institutional capacity-building.
Legal framework
Electronic Transactions and Cyber Security Act 2016 (Act No. 33 of 2016), supplemented by the Data Protection Act 2024, both administered by the Malawi Communications Regulatory Authority (MACRA) and the Malawi Computer Emergency Response Team (mwCERT)
Key points: cybersecurity in Malawi
Electronic Transactions and Cyber Security Act 2016
Act No. 33 of 2016, commenced June 2017, is the omnibus cybersecurity law. It criminalises unauthorised access/interception, cyber harassment, offensive communication, and child pornography online, and provides rules for electronic evidence and digital signatures.
mwCERT, national incident-response body
Data Protection Act 2024, breach notification
The Data Protection Act 2024 (commenced May 2024) requires data controllers to notify MACRA within 72 hours of discovering a personal-data breach; affected data subjects must also be notified within 72 hours where the breach poses a high risk. Processors must notify the controller within 72 hours. MACRA is the designated Data Protection Authority.
National Cybersecurity Strategy
Malawi adopted a National Cybersecurity Strategy (final draft published via ITU/PPPC) setting a vision for critical-infrastructure protection, legal and regulatory strengthening, and international cooperation. A national cyber-risk assessment identifying critical-information-infrastructure sectors was conducted in 2019-2020 with UK FCDO support.
MACRA as unified regulator
MACRA serves as both the telecommunications/ICT regulator (licensing, monitoring compliance) and the designated Data Protection Authority under the 2024 Act, consolidating cybersecurity oversight in a single body alongside mwCERT.
Global Cybersecurity Index progress
Malawi's ITU Global Cybersecurity Index score improved from 36% (2020) to 80% (2024), reflecting measurable advances in legal, technical, and organisational cybersecurity capacity, though implementation gaps and enforcement capacity remain areas for development.
Sources
- malawilii.org/akn/mw/act/2016/33/eng@2017-12-31
- macra.mw/wpfd_file/macra-electronic-transactions-cybersecurity-act-2016/
- dpa.mw/download/data-protection-act-2024/
- malawilii.org/akn/mw/act/gn/2024/40/eng@2024-05-31
- mwcert.mw/
- macra.mw/acts/
- itu.int/en/ITU-D/Cybersecurity/Documents/National_Strategies_Repository/00019
- api.pppc.mw/storage/160/National-Cybers-col.pdf
- itlawco.com/focus-areas/data-protection-and-privacy/malawis-data-protection-act-2
- iclg.com/practice-areas/cybersecurity-laws-and-regulations/malawi
- dataguidance.com/jurisdictions/malawi
- cybilportal.org/actors/malawi-communications-regulatory-authority-macra/
Next for Malawi: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026