Sends faxes, in Malawi

Credit Reference Bureau Act, 2010 (Cap. 46:09), Parts II, III and V · Read the law's page

• If you conduct credit reference bureau business, hold a licence as a credit reference bureau under the Financial Services Act, and be a limited liability company to be licensed.
• If you are a credit reference bureau, provide credit information services only to financial institutions regulated under the Financial Services Act, and give any other user access only after the user has submitted the account holder's written authorization to you.
• If you are a credit reference bureau, do not provide credit information of persons held in your database to a user or any other person for the purposes of offering or advertising goods, facilities or services to those persons.
• If you are a credit reference bureau, keep controls and procedures that protect the quality of your database and the confidentiality of its information, use the information collected only for the purposes of credit reference bureau business, and maintain a historical database covering seven years.
• If you are a credit reference bureau, let an account holder access the credit information held about them, free of charge on a screen, and remedy illegal, inaccurate, erroneous or outdated information promptly after a review request, correcting the errors in your database within ten working days.
• If you are a financial institution, submit credit information of your customers to all credit reference bureaux.

Data Protection Act, 2024, ss. 19-24, 26 (rights of a data subject) · Read the law's page

• Confirm to a data subject, on request, whether you process personal data concerning the data subject, and give the data subject access to it, including a copy in a commonly used electronic format within thirty days of receiving the request and, where practicable, at no expense to the data subject.
• Provide a data subject's personal data in a structured, commonly used and machine-readable format, or transmit it directly to another data controller the data subject names, within thirty days of receiving the request, where the processing is based on consent or contract or is carried out by automated means.
• Rectify an error in a data subject's personal data, or add supplementary data that completes it, within fourteen days of receiving the request or the supplementary data.
• Erase a data subject's personal data without undue delay on one of the section 22(1) grounds, and take reasonable steps to tell other data controllers and data processors known to be processing it to adhere to the request.
• Adhere to a data subject's request to restrict processing where the accuracy of the data is contested or you no longer need the data for the intended purpose of processing, unless you show cause, in writing, why the request cannot be adhered to.
• Cease processing personal data on a data subject's objection under section 24(1), unless you demonstrate a compelling legitimate ground that overrides the data subject's interest or right, or that the processing is necessary for the establishment, exercise or defence of a legal claim, and let a data subject object to processing for a direct marketing purpose.