MalawiElectronic Transactions and Cyber Security Act, 2016, rights of a data subject and information notice (Part VII)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Data subject rights
- Audit expectation
- none
What it requires
- When collecting personal data from a data subject, tell them who the data controller is, together with any representative, the purpose of the processing, and that they have rights of access, rectification and objection.NIST Privacy FrameworkCM.AW-P1
- Let a data subject obtain, without constraint or unreasonable delay and at no expense, confirmation of whether their data is being processed, communication of the data being processed and its source, and communication of the purposes of the processing and the recipients it is disclosed to.NIST Privacy FrameworkCT.DM-P1
- Honor a data subject's objection, made at any time on legitimate grounds relating to their situation, to the processing of their data, and stop processing that data once the objection is justified.NIST Privacy FrameworkCT.PO-P3
- Give a data subject, on request, the rectification, erasure or blocking of data whose processing does not comply with the Act, in particular because it is incomplete or inaccurate.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 72 and 73 give a data subject rights of access, objection, rectification, erasure and blocking, and require the controller to tell a person from whom data is collected who the controller is, the purposes and the existence of the rights. Neither section requires the controller to keep a record of requests, refusals or notices, and neither names an audit or inspection. The sections carry no scope clause, so there is no territorial hook.
- Kind
- None
- As of
What this law does
Section 72 entitles a data subject to obtain from a data controller, without constraint or unreasonable delay and at no expense, confirmation of whether data about him is being processed, communication of the data undergoing processing and its source, and communication of the purposes of the processing and the recipients the data is disclosed to.
The same section entitles a data subject to object at any time, on legitimate grounds relating to their situation, to the processing of data about them, and where the objection is justified the data controller may no longer process that data. It also entitles a data subject to obtain, as appropriate, the rectification, erasure or blocking of data whose processing does not comply with the Act, in particular because it is incomplete or inaccurate.
Section 73 requires a data controller, when collecting data from a data subject, to give them the identity of the controller and any representative, the purpose of the processing, and the existence of the rights of access, rectification and objection.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .