LexLint

Know the law your code answers to.

Law / Malawi

Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)

Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71, 74)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 June 2017.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Process personal data fairly and lawfully, collect it only for specified, explicit and legitimate purposes, and do not process it further in a way incompatible with those purposes.
  • Keep personal data adequate, relevant and not excessive for its purpose, accurate and up to date, and take every reasonable step to erase or rectify data that is inaccurate or incomplete; do not keep it in identifiable form for longer than the purpose requires.
  • Have a lawful basis before processing personal data: the data subject's unambiguous consent, contractual necessity, compliance with a legal obligation, protecting the data subject's vital interests, a public interest or official task, or your own legitimate interests where they do not override the data subject's rights and freedoms.
  • Implement technical and organizational security measures appropriate to the risk, including where you transmit personal data over a network, to protect it against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Part VII states no penalty of its own; a breach falls to section 95's general default offence, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision of the Act whose penalty is not otherwise stated.

Penalty structure

The Act's general default penalty (s. 95), applied because Part VII states no penalty of its own; also carries imprisonment of up to seven years.

Rule
Fixed only
As of
19 September 2026
Currency
MWK
Fixed cap
5,000,000

Who enforces it

Enforcement body

Malawi Communications Regulatory Authority

What it reaches

Obligation class

Consent, Retention, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 71 requires a data controller to process personal data fairly and legally, collect it only for specified, explicit and legitimate purposes, and not process it further in a way incompatible with those purposes.

The same section requires a data controller to keep personal data adequate, relevant and not excessive, accurate and up to date, to take every reasonable step to erase or rectify data that is inaccurate or incomplete, and to keep it in identifiable form no longer than the purpose for which it was collected requires.

Personal data may be processed only where the data subject has unambiguously consented, where processing is necessary for a contract with the data subject or for compliance with a legal obligation, to protect the data subject's vital interests, for a task carried out in the public interest or an official authority, or for the controller's own legitimate interests where these do not override the data subject's rights and freedoms.

Section 74 requires a data controller to implement technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and other unlawful processing, at a level appropriate to the risk.

Part VII states no penalty of its own, so a breach falls to the Act's general default offence at section 95, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision whose penalty is not otherwise stated. Part VII sets no cross-border-transfer rule, no rule specific to sensitive or biometric data, and no dedicated breach-notification duty to a regulator or to the data subject.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

Malawi Electronic Transactions and Cyber Security Act
Chapter 74:02, consolidated to 31 December 2017, Laws.Africa text hosted by MalawiLII (CC BY)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app