MalawiElectronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)
Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71, 74)
In force since .
A comprehensive regime rule binding public and private bodies.
- Enforcement body
- Malawi Communications Regulatory Authority
- Obligation class
- Consent, Retention, Security
- Audit expectation
- none
What it requires
- Process personal data fairly and lawfully, collect it only for specified, explicit and legitimate purposes, and do not process it further in a way incompatible with those purposes.NIST Privacy FrameworkGV.PO-P1
- Keep personal data adequate, relevant and not excessive for its purpose, accurate and up to date, and take every reasonable step to erase or rectify data that is inaccurate or incomplete; do not keep it in identifiable form for longer than the purpose requires.NIST Privacy FrameworkGV.PO-P1
- Have a lawful basis before processing personal data: the data subject's unambiguous consent, contractual necessity, compliance with a legal obligation, protecting the data subject's vital interests, a public interest or official task, or your own legitimate interests where they do not override the data subject's rights and freedoms.NIST Privacy FrameworkCT.PO-P1
- Implement technical and organizational security measures appropriate to the risk, including where you transmit personal data over a network, to protect it against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Part VII states no penalty of its own; a breach falls to section 95's general default offence, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision of the Act whose penalty is not otherwise stated.
Penalty structure
The Act's general default penalty (s. 95), applied because Part VII states no penalty of its own; also carries imprisonment of up to seven years.
- Rule
- Fixed only
- As of
- Currency
- MWK
- Fixed cap
- 5,000,000
What it makes you log
Logging duty
Section 71 sets the principles for processing personal data, including that data is kept in identifiable form no longer than necessary for its purpose, which limits the personal data and not a record. Section 74 requires technical and organizational security measures appropriate to the risk, and says nothing of keeping a log, a register or a record of processing. The cyber inspector's powers in section 70 are outside the cited sections. The cited sections carry no scope clause, so there is no territorial hook.
- Kind
- None
- As of
What this law does
Section 71 requires a data controller to process personal data fairly and legally, collect it only for specified, explicit and legitimate purposes, and not process it further in a way incompatible with those purposes.
The same section requires a data controller to keep personal data adequate, relevant and not excessive, accurate and up to date, to take every reasonable step to erase or rectify data that is inaccurate or incomplete, and to keep it in identifiable form no longer than the purpose for which it was collected requires.
Personal data may be processed only where the data subject has unambiguously consented, where processing is necessary for a contract with the data subject or for compliance with a legal obligation, to protect the data subject's vital interests, for a task carried out in the public interest or an official authority, or for the controller's own legitimate interests where these do not override the data subject's rights and freedoms.
Section 74 requires a data controller to implement technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and other unlawful processing, at a level appropriate to the risk.
Part VII states no penalty of its own, so a breach falls to the Act's general default offence at section 95, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision whose penalty is not otherwise stated. Part VII sets no cross-border-transfer rule, no rule specific to sensitive or biometric data, and no dedicated breach-notification duty to a regulator or to the data subject.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .