Processes personal data, in Malawi

Credit Reference Bureau Act, 2010 (Cap. 46:09), Parts II, III and V · Read the law's page

• If you conduct credit reference bureau business, hold a licence as a credit reference bureau under the Financial Services Act, and be a limited liability company to be licensed.
• If you are a credit reference bureau, provide credit information services only to financial institutions regulated under the Financial Services Act, and give any other user access only after the user has submitted the account holder's written authorization to you.
• If you are a credit reference bureau, do not provide credit information of persons held in your database to a user or any other person for the purposes of offering or advertising goods, facilities or services to those persons.
• If you are a credit reference bureau, keep controls and procedures that protect the quality of your database and the confidentiality of its information, use the information collected only for the purposes of credit reference bureau business, and maintain a historical database covering seven years.
• If you are a credit reference bureau, let an account holder access the credit information held about them, free of charge on a screen, and remedy illegal, inaccurate, erroneous or outdated information promptly after a review request, correcting the errors in your database within ten working days.
• If you are a financial institution, submit credit information of your customers to all credit reference bureaux.

Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71, 74) · Read the law's page

• Process personal data fairly and lawfully, collect it only for specified, explicit and legitimate purposes, and do not process it further in a way incompatible with those purposes.
• Keep personal data adequate, relevant and not excessive for its purpose, accurate and up to date, and take every reasonable step to erase or rectify data that is inaccurate or incomplete; do not keep it in identifiable form for longer than the purpose requires.
• Have a lawful basis before processing personal data: the data subject's unambiguous consent, contractual necessity, compliance with a legal obligation, protecting the data subject's vital interests, a public interest or official task, or your own legitimate interests where they do not override the data subject's rights and freedoms.
• Implement technical and organizational security measures appropriate to the risk, including where you transmit personal data over a network, to protect it against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.

ss. 72-73, Electronic Transactions and Cyber Security Act, 2016 (rights of a data subject; information notice) · Read the law's page

• When collecting personal data from a data subject, tell them who the data controller is, together with any representative, the purpose of the processing, and that they have rights of access, rectification and objection.
• Let a data subject obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their data is being processed, communication of the data being processed and its source, and communication of the purposes of the processing and the recipients it is disclosed to.
• Honor a data subject's objection, made at any time on legitimate grounds relating to their situation, to the processing of their data, and stop processing that data once the objection is justified.
• Give a data subject, on request, the rectification, erasure or blocking of data whose processing does not comply with the Act, in particular because it is incomplete or inaccurate.

Data Protection Act, 2024 · Read the law's page

• Comply with the Data Protection Act, 2024's rules for collecting, processing, storing, and sharing personal data, whether the personal data belongs to a private individual or is held by a public organisation.
• Expect the Malawi Communications Regulatory Authority, acting as the Data Protection Authority, to regulate, monitor, and enforce compliance with the Act.

Data Protection Act, 2024, ss. 16, 18 (sensitive personal data; criminal offence data) · Read the law's page

• Do not process sensitive personal data (biometric data, race or ethnic origin, religious or other belief relating to the freedom of conscience, health status, political opinion or affiliation, or any other category the Minister prescribes) unless one of the grounds in section 16(1) applies, such as the data subject's consent to the processing for a specific purpose.
• Put in place appropriate measures to safeguard the fundamental rights and interests of the data subject when you process sensitive personal data on a section 16(1) ground.
• Do not process personal data relating to a criminal offence, conviction or security measure imposed on the data subject unless a written law authorizes the processing and provides the necessary safeguards, or the processing is carried out under the control of an organ of Government or other official authority.

Data Protection Act, 2024, ss. 19-24, 26 (rights of a data subject) · Read the law's page

• Confirm to a data subject, on request, whether you process personal data concerning the data subject, and give the data subject access to it, including a copy in a commonly used electronic format within thirty days of receiving the request and, where practicable, at no expense to the data subject.
• Provide a data subject's personal data in a structured, commonly used and machine-readable format, or transmit it directly to another data controller the data subject names, within thirty days of receiving the request, where the processing is based on consent or contract or is carried out by automated means.
• Rectify an error in a data subject's personal data, or add supplementary data that completes it, within fourteen days of receiving the request or the supplementary data.
• Erase a data subject's personal data without undue delay on one of the section 22(1) grounds, and take reasonable steps to tell other data controllers and data processors known to be processing it to adhere to the request.
• Adhere to a data subject's request to restrict processing where the accuracy of the data is contested or you no longer need the data for the intended purpose of processing, unless you show cause, in writing, why the request cannot be adhered to.
• Cease processing personal data on a data subject's objection under section 24(1), unless you demonstrate a compelling legitimate ground that overrides the data subject's interest or right, or that the processing is necessary for the establishment, exercise or defence of a legal claim, and let a data subject object to processing for a direct marketing purpose.

Data Protection Act, 2024, ss. 36-37 (notification of personal data breach) · Read the law's page

• Notify the Authority of a personal data breach within seventy-two hours of becoming aware of it, describing the nature of the breach, where possible the categories of personal data and the number of data subjects affected, its likely consequences, the measures taken or proposed, and the name and contact details of your data protection officer.
• Where you cannot give all of that information within seventy-two hours, provide it as soon as it becomes available.
• Keep a record of each personal data breach and of the information the notification to the Authority must include.
• If you are a data processor, notify the data controller of a personal data breach within seventy-two hours of becoming aware of it, with the particulars the notification to the Authority must include.
• Where a personal data breach is of high risk to the rights and freedoms of a data subject, notify the data subject within seventy-two hours of becoming aware of the breach, describing the nature of the breach, its likely consequence and the measures taken or proposed.
• Where notifying the data subject involves a disproportionate effort or expense, make a public notification in at least one newspaper of wide circulation in Malawi and any other mode of communication you consider appropriate.

Data Protection Act, 2024, ss. 38-40 (cross-border transfer of personal data) · Read the law's page

• Do not transfer personal data from Malawi to another country or an international organization unless the recipient is subject to a law, binding corporate rule, personal data protection contractual clause, code of conduct or certification mechanism that affords an adequate level of protection, or one of the conditions in section 39(4) applies.
• Keep a record of the basis for each transfer of personal data from Malawi to another country or an international organization.
• Where the recipient does not provide an adequate level of protection, transfer personal data only where the data subject has consented after being informed of the possible risk, where the transfer is necessary for a contract with the data subject or for a contract with a third party in the data subject's interest, or where the transfer is for the data subject's benefit and obtaining consent is not reasonably practicable or the data subject would likely give it.
• Submit any binding corporate rules, code of conduct or certification mechanism you adopt to the Authority.

Data Protection Act, 2024, ss. 4-5, 44-48 (enforcement and supervision) · Read the law's page

• Comply with a compliance order the Authority issues after an investigation, which may require you to comply with a specified provision of the Act, to stop or refrain from an act that contravenes it, to pay compensation to an affected data subject, to account for profits made out of the contravention, or to pay an administrative penalty.
• When the Authority orders you, for an investigation, to attend and be examined, to produce a document, record or article, or to furnish a written statement made under oath, comply, and where the material is stored in a mechanical or electronic device give the Authority access to it in a legible, structured and commonly used and machine-readable format when it requires that.
• Do not obstruct or interfere with the Authority, an officer of the Authority or a person it authorizes in the performance of any function under the Act.