MalawiData Protection Act, 2024, sensitive personal data and criminal offence data
Data Protection Act, 2024, ss. 16, 18 (sensitive personal data; criminal offence data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://macra.mw/download/25/rulesregulations/252806/data-protection-act-2024.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not process sensitive personal data (biometric data, race or ethnic origin, religious or other belief relating to the freedom of conscience, health status, political opinion or affiliation, or any other category the Minister prescribes) unless one of the grounds in section 16(1) applies, such as the data subject's consent to the processing for a specific purpose.
- Put in place appropriate measures to safeguard the fundamental rights and interests of the data subject when you process sensitive personal data on a section 16(1) ground.
- Do not process personal data relating to a criminal offence, conviction or security measure imposed on the data subject unless a written law authorizes the processing and provides the necessary safeguards, or the processing is carried out under the control of an organ of Government or other official authority.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 16 bars processing of sensitive personal data except on a listed ground and requires safeguards, and section 18 bars processing of criminal offence data except under a written law or official control. Neither section requires a record, a log or a register to be made or kept, and neither names an audit. The sections carry no scope clause of their own, so no territorial hook is read.
- Kind
- None
- As of
What this law does
Section 2 defines sensitive personal data to cover biometric data, race or ethnic origin, religious or other belief relating to the freedom of conscience, health status, political opinion or affiliation, and such other data as the Minister may prescribe. Section 16(1) bars a data controller and data processor from processing sensitive personal data of a data subject unless one of the grounds listed in that subsection applies.
The grounds in section 16(1) include the data subject's consent for a specific purpose, public health, public interest, the establishment, exercise or defence of a legal claim, archiving or research, the data subject having intentionally made the data public, and processing by a not-for-profit body in the course of its legitimate activity for its members.
Section 16(2) requires a data controller or data processor that processes sensitive personal data on one of those grounds to put in place appropriate measures to safeguard the fundamental rights and interests of the data subject. Section 16(3) lets the Minister, on the recommendation of the Authority and by order published in the Gazette, prescribe additional categories of personal data to be classified as sensitive data.
Section 18(1) bars processing of personal data relating to a criminal offence, conviction or security measure imposed on the data subject unless a written law authorizes it and provides the necessary safeguards, or it is carried out under the control of an organ of Government or other official authority. A notice of commencement published in the Malawi Gazette Supplement of appointed as the date on which the Data Protection Act, 2024 came into operation.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .