MalawiData Protection Act, 2024, enforcement and supervision
Data Protection Act, 2024, ss. 4-5, 44-48 (enforcement and supervision)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://macra.mw/download/25/rulesregulations/252806/data-protection-act-2024.pdfIn force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Malawi Communications Regulatory Authority
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with a compliance order the Authority issues after an investigation, which may require you to comply with a specified provision of the Act, to stop or refrain from an act that contravenes it, to pay compensation to an affected data subject, to account for profits made out of the contravention, or to pay an administrative penalty.
- When the Authority orders you, for an investigation, to attend and be examined, to produce a document, record or article, or to furnish a written statement made under oath, comply, and where the material is stored in a mechanical or electronic device give the Authority access to it in a legible, structured and commonly used and machine-readable format when it requires that.
- Do not obstruct or interfere with the Authority, an officer of the Authority or a person it authorizes in the performance of any function under the Act.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 45(4) makes failure to comply with a compliance order, other than an order to pay compensation, an administrative penalty or to make good profits, an offence punishable on conviction by a fine of K10,000,000 and imprisonment for two years for a natural person and by a fine of K50,000,000 for a legal person. Section 48 makes obstructing or interfering with the Authority an offence punishable on conviction by a fine of K10,000,000 and imprisonment for two years.
Penalty structure
Section 45(2)(e) lets a compliance order require payment of an administrative penalty not exceeding K20,000,000. The criminal fines in sections 45(4) and 48 are separate and are stated in the criminal exposure note.
- Rule
- Fixed only
- As of
- Currency
- MWK
- Fixed cap
- 20,000,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 44 to 48 let the Authority take complaints, investigate, order a person to produce a document, record or article, issue compliance orders, and create offences and a civil remedy. Section 44(5)(b) is a power to demand what exists and not a duty to keep or log anything, and no section in the row requires a record to be made or kept. The row cites no territorial clause, so no hook is read.
- Kind
- None
- As of
What this law does
Section 4(1) designates the Malawi Communication Regulatory Authority as the Data Protection Authority. Section 5(1) requires the Authority to regulate the processing of personal data as prescribed under the Act and makes it responsible for the enforcement of the Act. Section 44(1) lets a data subject who is aggrieved by any action or inaction of a data controller or data processor lodge a complaint, in writing, with the Authority.
Section 44(3) requires the Authority to investigate a complaint lodged within ninety days of the action or inaction it is based on that is not frivolous or vexatious. Section 44(4) lets the Authority investigate on its own initiative where it has reasonable grounds to believe that a data controller or data processor has contravened, or is likely to contravene, the Act.
Section 44(5) lets the Authority order any person to attend to be examined orally, to produce any document, record or article relevant to the investigation, or to furnish a written statement made under oath. Section 44(6) lets the Authority require the person in the custody of information stored in a mechanical or electronic device to produce it, or give the Authority access to it, in a legible, structured and commonly used and machine-readable format.
Section 45(1) requires the Authority to issue an appropriate compliance order to a data controller or data processor it is satisfied has contravened, or is likely to contravene, the Act. Section 45(2) lets a compliance order require compliance with a provision, a cease and desist, compensation to a data subject, an account of profits, an administrative penalty, or any other order the Authority considers just and appropriate. Section 45(2)(e) caps the administrative penalty at K20,000,000.
Section 45(4) makes it an offence, punishable on conviction by a fine of K10,000,000 and imprisonment for two years for a natural person and by a fine of K50,000,000 for a legal person, to fail to comply with a compliance order other than an order to pay compensation, an administrative penalty or to make good profits. Section 46(1) lets a person aggrieved by a decision of the Authority apply to the High Court for review within thirty days of receiving the decision.
Section 47 lets a data subject who suffers injury, loss or harm as a result of a contravention of the Act by a data controller or data processor commence legal action for a civil remedy against it. Section 48 makes it an offence, punishable on conviction by a fine of K10,000,000 and imprisonment for two years, to obstruct or interfere with the Authority, an officer of the Authority or a person it authorizes in the performance of any function under the Act.
A notice of commencement published in the Malawi Gazette Supplement of appointed as the date on which the Data Protection Act, 2024 came into operation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .