MalawiData Protection Act, 2024, rights of a data subject
Data Protection Act, 2024, ss. 19-24, 26 (rights of a data subject)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://macra.mw/download/25/rulesregulations/252806/data-protection-act-2024.pdfIn force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Confirm to a data subject, on request, whether you process personal data concerning the data subject, and give the data subject access to it, including a copy in a commonly used electronic format within thirty days of receiving the request and, where practicable, at no expense to the data subject.
- Provide a data subject's personal data in a structured, commonly used and machine-readable format, or transmit it directly to another data controller the data subject names, within thirty days of receiving the request, where the processing is based on consent or contract or is carried out by automated means.
- Rectify an error in a data subject's personal data, or add supplementary data that completes it, within fourteen days of receiving the request or the supplementary data.
- Erase a data subject's personal data without undue delay on one of the section 22(1) grounds, and take reasonable steps to tell other data controllers and data processors known to be processing it to adhere to the request.
- Adhere to a data subject's request to restrict processing where the accuracy of the data is contested or you no longer need the data for the intended purpose of processing, unless you show cause, in writing, why the request cannot be adhered to.
- Cease processing personal data on a data subject's objection under section 24(1), unless you demonstrate a compelling legitimate ground that overrides the data subject's interest or right, or that the processing is necessary for the establishment, exercise or defence of a legal claim, and let a data subject object to processing for a direct marketing purpose.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 19 to 24 and 26 give a data subject rights of access, portability, rectification, erasure, restriction and objection, and let those rights be restricted for the purposes section 26 lists. None of them requires a record of requests or refusals to be made or kept, and none names an audit. Section 23(2) asks for cause to be shown in writing where a restriction request is not adhered to, a statement owed to the data subject and not a record the section requires to be kept. The sections carry no scope clause of their own, so no territorial hook is read.
- Kind
- None
- As of
What this law does
Section 19(1) gives a data subject the right to obtain from a data controller or data processor confirmation of whether personal data concerning the data subject is being processed and, where it is, the right to access that data. Section 19(2) requires the data controller or data processor to provide a copy of the personal data in a commonly used electronic format within thirty days of receipt of the request and, where practicable, at no expense to the data subject.
Section 20(1) gives a data subject the right to receive personal data concerning the data subject from a data controller in a structured, commonly used and machine-readable format. That right under section 20(1) applies where the processing is based on consent or on fulfilment of a contractual obligation, or is carried out by automated means.
Section 20(2) requires a data controller, on request, to provide the personal data in a commonly used and machine-readable format or to transmit it directly to another data controller specified in the request, within thirty days of receipt of the request. Section 21(3) requires a data controller or data processor to rectify an error in personal data, or add supplementary data that completes it, within fourteen days of receipt of the request or the supplementary data.
Section 22(1) gives a data subject the right to erasure of personal data without undue delay where it is no longer necessary for its purpose, the data subject withdraws consent and there is no other legal ground, the data subject objects under section 24 and there is no overriding legitimate ground, the data was unlawfully processed, or a written law requires erasure.
Section 22(2) requires a data controller or data processor that receives an erasure request to take reasonable steps to inform other data controllers and data processors known to be processing the data to adhere to the request. Section 23(1) gives a data subject the right to restrict processing where the accuracy of the data is contested or the data is no longer needed for the intended purpose of processing.
Section 23(2) requires a data controller or data processor to adhere to a restriction request unless it shows cause, in writing, why the request cannot be adhered to. Section 24(2) requires a data controller or data processor to cease processing on receipt of an objection under section 24(1) unless it demonstrates a compelling legitimate ground that overrides the interest or right of the data subject or that the processing is necessary for a legal claim.
Section 24(3) lets a data subject object to the processing of personal data for a direct marketing purpose. Section 26 allows the rights in Part IV to be restricted where the processing is for national security, the prevention, investigation, detection or prosecution of a criminal offence, a national economic or financial interest, public health, social security or judicial proceedings, among the listed purposes.
A notice of commencement published in the Malawi Gazette Supplement of appointed as the date on which the Data Protection Act, 2024 came into operation.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .