MalawiData Protection Act, 2024, cross-border transfer of personal data
Data Protection Act, 2024, ss. 38-40 (cross-border transfer of personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://macra.mw/download/25/rulesregulations/252806/data-protection-act-2024.pdfIn force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data from Malawi to another country or an international organization unless the recipient is subject to a law, binding corporate rule, personal data protection contractual clause, code of conduct or certification mechanism that affords an adequate level of protection, or one of the conditions in section 39(4) applies.
- Keep a record of the basis for each transfer of personal data from Malawi to another country or an international organization.
- Where the recipient does not provide an adequate level of protection, transfer personal data only where the data subject has consented after being informed of the possible risk, where the transfer is necessary for a contract with the data subject or for a contract with a third party in the data subject's interest, or where the transfer is for the data subject's benefit and obtaining consent is not reasonably practicable or the data subject would likely give it.
- Submit any binding corporate rules, code of conduct or certification mechanism you adopt to the Authority.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 38(2) requires a data controller and data processor to keep a record of the basis for the transfer of personal data from Malawi to another country or an international organization. The clause names no field of the record from the listed values, sets no retention period and names no one entitled to see it. Section 40 requires the adopted corporate rules, code of conduct or certification mechanism to be submitted to the Authority, which is a filing and is not a check of the record. The row cites no territorial clause, so no hook is read.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act, 2024, section 38(2)
- Trigger
- personal_data_processing
What this law does
Section 38(1) bars a data controller and data processor from transferring personal data from Malawi to another country or an international organization unless the recipient is subject to a law, binding corporate rule, personal data protection contractual clause, code of conduct or certification mechanism that affords an adequate level of protection, or a condition in section 39(4) applies.
Section 38(2) requires a data controller and data processor to keep a record of the basis for the transfer of personal data from Malawi to another country or an international organization. Section 39(1) requires the Authority, on application by a data controller or on its own initiative, to assess whether an international organization or a recipient of personal data outside Malawi provides adequate level of protection of personal data.
Section 39(3) lets the Authority decide on adequacy based on a comparable adequacy decision made by a competent data protection authority in another country. Section 39(4)(a) permits a transfer to a recipient that does not provide an adequate level of protection where the data subject has provided consent to the transfer after being informed of the possible risk of the transfer.
Section 39(4)(b) permits such a transfer where it is necessary for the performance of a contract to which the data subject is a party or the implementation of a pre-contractual measure taken at the data subject's request. Section 39(4)(c) permits such a transfer where it is necessary for the conclusion or performance of a contract between the data controller and a third party which is in the interest of the data subject.
Section 39(4)(d) permits such a transfer where it is for the benefit of the data subject and obtaining consent is not reasonably practicable, or the data subject would likely give the consent if it were. Section 39(5) lets the Minister, by notice published in the Gazette, designate a country, region or specified sector within a country, or a standard personal data protection contractual clause, as affording an adequate level of protection.
Section 40 requires a data controller or data processor that adopts binding corporate rules, a code of conduct or a certification mechanism to submit it to the Authority. A notice of commencement published in the Malawi Gazette Supplement of appointed as the date on which the Data Protection Act, 2024 came into operation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .