Skip to content
World Watch

Data protection & privacy law in Malawi (2026)

Data protection in Malawi: comprehensive law.

Malawi enacted the Data Protection Act 2024, gazetted in February 2024 and commenced on 3 June 2024, replacing the data-protection provisions of the Electronic Transactions and Cyber Security Act 2016. The Act introduces a GDPR-inspired regime covering lawful-basis processing, data-subject rights, mandatory breach notification, and registration requirements for significant data controllers. An independent Data Protection Authority (dpa.mw) has been established to oversee enforcement, with MACRA playing an operational support role.

Last verified Official sources first · MethodologyCompare Malawi with other countries

Legal framework

Data Protection Act 2024 (in force 3 June 2024); supervised by the Data Protection Authority (DPA), established under the Act and supported by MACRA

Key points: data & privacy in Malawi

  1. Enactment & commencement

    The Data Protection Act 2024 was gazetted in February 2024 and officially came into force on 3 June 2024 via Government Notice No. 40 of 2024, replacing Part VII of the Electronic Transactions and Cyber Security Act 2016 as the primary data-protection instrument.

    malawilii.org dpa.mw

  2. Supervisory authority

    The Act establishes an independent Data Protection Authority (DPA) headquartered at dpa.mw, responsible for issuing guidance, receiving complaints, conducting investigations, and issuing compliance orders. MACRA hosts and operationally supports the DPA during its stand-up phase.

    dpa.mw macra.mw

  3. Processing principles & lawful bases

    Data controllers and processors must adhere to eight principles: lawfulness, transparency, fairness, purpose limitation, data minimisation, accuracy, storage limitation, and integrity/confidentiality. Recognised lawful bases include consent, contract performance, legal obligation, vital interests, public interest, and legitimate interests.

    itlawco.com dpa.mw

  4. Data-subject rights

    Data subjects are granted rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing, closely mirroring the GDPR rights framework.

    itlawco.com cipit.strathmore.edu

  5. Breach notification & DPIA

    Controllers must notify the DPA within 72 hours of discovering a breach; if the breach poses high risk to data subjects, those individuals must also be notified within 72 hours. A Data Protection Impact Assessment (DPIA) is mandatory before high-risk processing activities begin.

    techhiveadvisory.africa dataprotection.africa

  6. Registration requirements

    Data controllers and processors of 'significant importance', defined as those processing data of more than 10,000 data subjects, or data of national economic, social, or security significance, must register with the DPA.

    dpa.mw itlawco.com

Sources

  1. dpa.mw/
  2. dpa.mw/download/data-protection-act-2024/
  3. malawilii.org/akn/mw/act/gn/2024/40/eng@2024-05-31
  4. macra.mw/wpfd_file/data-protection-act-2024/
  5. itlawco.com/focus-areas/data-protection-and-privacy/malawis-data-protection-act-2
  6. dataprotection.africa/malawi/
  7. cipit.strathmore.edu/review-of-the-malawi-data-protection-act-2024/
  8. techhiveadvisory.africa/insights/malawis-data-protection-act-aligning-to-the-new-regulatory-f
  9. dpa.mw/about-us/

Next for Malawi: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026