in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law3 instruments, 3 in force
Research summary (623 words)
Malawi's comprehensive personal-data statute is the Data Protection Act, 2024 (No. 3 of 2024), which came into operation on and designates the Malawi Communications Regulatory Authority (MACRA) as the Data Protection Authority.
It applies to the processing of personal data in Malawi by a data controller or data processor domiciled, ordinarily resident or operating there, and to the processing of personal data of a data subject within Malawi by a controller or processor outside Malawi that offers goods or services to that person or monitors the person's behavior in Malawi; it excludes processing in the course of a solely personal, recreational or household activity and the mere transmission of personal data through Malawi.
Processing must be lawful, fair and transparent, and rests on the data subject's consent or on a listed ground such as contract, legal obligation, vital interests, a task in the public interest or a legitimate interest; sensitive personal data (biometric data, race or ethnic origin, belief, health status, and political opinion or affiliation) may be processed only on a narrower list of grounds.
A data subject has rights of access, portability, rectification, erasure, restriction and objection, and a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect.
A data controller must notify the Authority of a personal data breach within seventy-two hours of becoming aware of it, and must notify the data subject within seventy-two hours where the breach is of high risk to the data subject's rights and freedoms. Personal data may leave Malawi only to a recipient subject to a law, binding corporate rule, contractual clause, code of conduct or certification mechanism that affords an adequate level of protection, or where a listed condition applies.
The Authority may issue a compliance order, including one requiring compensation or an administrative penalty not exceeding K20,000,000, and a data subject who suffers injury, loss or harm from a contravention may bring an action for a civil remedy. A controller or processor that is not of significant importance was exempt from compliance for twenty-four months from commencement, a period that ran to , and one that is of significant importance was to comply within six months.
The 2024 Act has no repeal section and leaves the Electronic Transactions and Cyber Security Act, 2016 standing: section 3(3) provides that the 2024 Act does not affect the rights and obligations of a data controller and data processor prescribed under Part IV of the 2016 Act, a Part that deals with the liability of online intermediaries, while the 2016 Act's data protection and privacy provisions are in Part VII.
Part VII of the 2016 Act, in force since , binds a data controller, any person who determines the purpose and manner of processing, to process personal data fairly and lawfully, collect it only for specified and legitimate purposes, keep it adequate, relevant, accurate and no longer than necessary, and process it only on a lawful basis such as the data subject's unambiguous consent, contractual necessity, or a legal obligation.
That Part also entitles a data subject to confirmation of whether their data is being processed, access to it and its source, objection to its processing, and rectification, erasure or blocking of data that does not comply with the 2016 Act, gives them an information notice at collection, and requires a data controller to implement technical and organizational security measures; it sets no cross-border-transfer rule, no rule specific to sensitive or biometric data, and no dedicated breach-notification duty, and states no penalty specific to a Part VII breach, so the 2016 Act's general default offence (a fine of K5,000,000 and imprisonment for seven years) applies.
Data Protection Act, 2024Malawi Communications Regulatory Authority (MACRA), file listing for the Act, and MACRA's own account of the Act on its website
The Malawi Communications Regulatory Authority (MACRA) describes the Act as positioning MACRA itself as the Data Protection Authority, charged with regulating, monitoring, and enforcing compliance around how personal data is collected, processed, stored, and shared across sectors, and as promoting responsible management of personal data by both public and private organisations. Section 1 of the Act lets the Minister appoint the date on which the Act comes into operation.
By a notice of commencement published in the Malawi Gazette Supplement of , the Minister of Information and Digitalization appointed as the date on which the Act came into operation.
Section 71 requires a data controller to process personal data fairly and legally, collect it only for specified, explicit and legitimate purposes, and not process it further in a way incompatible with those purposes.
The same section requires a data controller to keep personal data adequate, relevant and not excessive, accurate and up to date, to take every reasonable step to erase or rectify data that is inaccurate or incomplete, and to keep it in identifiable form no longer than the purpose for which it was collected requires.
Personal data may be processed only where the data subject has unambiguously consented, where processing is necessary for a contract with the data subject or for compliance with a legal obligation, to protect the data subject's vital interests, for a task carried out in the public interest or an official authority, or for the controller's own legitimate interests where these do not override the data subject's rights and freedoms.
Section 74 requires a data controller to implement technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and other unlawful processing, at a level appropriate to the risk.
Part VII states no penalty of its own, so a breach falls to the Act's general default offence at section 95, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision whose penalty is not otherwise stated. Part VII sets no cross-border-transfer rule, no rule specific to sensitive or biometric data, and no dedicated breach-notification duty to a regulator or to the data subject.
Section 72 entitles a data subject to obtain from a data controller, without constraint or unreasonable delay and at no expense, confirmation of whether data about him is being processed, communication of the data undergoing processing and its source, and communication of the purposes of the processing and the recipients the data is disclosed to.
The same section entitles a data subject to object at any time, on legitimate grounds relating to their situation, to the processing of data about them, and where the objection is justified the data controller may no longer process that data. It also entitles a data subject to obtain, as appropriate, the rectification, erasure or blocking of data whose processing does not comply with the Act, in particular because it is incomplete or inaccurate.
Section 73 requires a data controller, when collecting data from a data subject, to give them the identity of the controller and any representative, the purpose of the processing, and the existence of the rights of access, rectification and objection.
Malawi has no scraping-specific statute, so general law governs each dimension separately.
The Electronic Transactions and Cyber Security Act, 2016 prohibits a person from gaining unauthorized access to, intercepting, or interfering with data, and separately makes it an offence to intentionally access or intercept data without authority or permission, or to exceed authorized access; unlike some neighbouring jurisdictions' computer-misuse laws, the offence does not require that the person defeat a security measure to gain access, so whether reading a public, unauthenticated page without logging in or accepting terms falls within accessing data 'without authority or permission' is unsettled, and no reported Malawian case has tested the point.
No Malawian court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.
The Copyright Act, 2016 permits quotations from a lawfully published work, including newspaper press summaries, and reproduction for reporting current events, both subject to a fair-practice and extent-justified test, and separately permits critical or scientific use and personal or private single-copy use, but it has no text-and-data-mining exception, so training a model on scraped copyrighted text does not obviously fit any of the Act's permitted-use categories.
The Act protects a 'compilation of data' as an intellectual creation by reason of its selection or arrangement, but its own definition states that this protection does not extend to the data itself, so Malawi confers no sui generis database right beyond ordinary compilation copyright.
The Electronic Transactions and Cyber Security Act's personal-data provisions apply to personal data without a general carve-out for information that is publicly accessible, so scraping personal data from a public Malawian website remains subject to the Act's fair-processing, purpose-limitation and lawful-basis duties.
No Malawian statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
Section 84(1) prohibits a person from gaining unauthorized access to, or intercepting, or interfering with data. Section 84(3) makes it an offence for a person to intentionally access or intercept any data without authority or permission to do so, or to exceed authorized access, punishable on conviction by a fine of K2,000,000 and imprisonment for five years; unlike Kenya's neighbouring provision, the offence does not require defeating a security measure to gain access.
Section 84(10) raises the penalty to imprisonment of not less than ten and not more than fifteen years, with no separate fine stated, where the data concerned is data connected with national security or the provision of an essential service. Because the offence turns on accessing data without authority rather than on circumventing a technical control, its reach to a scraper reading a public, unauthenticated page is unsettled.
Malawi has no Digital Single Market-style press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.
The relevant instrument is the Copyright Act, 2016, which repealed the earlier Copyright Act, and whose section 39 permits, without the copyright owner's consent, the inclusion of quotations from a lawfully published work in another work, including quotations from newspaper articles and periodicals in the form of press summaries, subject to a fair-practice and extent-justified test.
Section 45 separately permits reproducing and making available to the public a work that can be seen or heard in the course of a current event, for the purpose of reporting on that event, to the extent justified for an informative purpose.
Neither provision is capped at a headline-length or short-extract threshold beyond the fair-practice test, and no reported Malawian decision applies either to a systematic news aggregator, as opposed to a traditional press summary or a broadcaster's current-events report.
Section 82 gives a publisher a right against facsimile reproduction of the typographical arrangement of a published edition, lasting twenty-five years from the end of the year the edition was first published, but this protects the printed page layout against photocopying, not the underlying text or headlines, so it does not reach a news aggregator's reproduction of content the way a Digital Single Market Article 15-style neighbouring right would.
The Act defines a 'compilation of data' as protected by reason of its selection or arrangement, but expressly states that this protection does not extend to the data itself, so the Act predates and has no equivalent of a machine-readable text-and-data-mining reservation.
Section 39 permits, without the copyright owner's consent, the inclusion of quotations from a work in another work, including quotations from newspaper articles and periodicals in the form of press summaries, provided the work quoted has already been lawfully made available to the public and the quotation is compatible with fair practice and does not exceed the extent justified by the purpose.
Section 45 permits reproducing a work and making available to the public any work that can be seen or heard in the course of a current event, for the purpose of reporting on that event, by photography, cinematography or other means of communication, to the extent justified for an informative purpose. Neither section carries a headline-length or short-extract cap distinct from these fair-practice and informative-purpose tests.
The Act's Part VIII neighbouring rights also give a publisher, under section 82, a right against facsimile reproduction of the typographical arrangement of a published edition, lasting twenty-five years from the end of the year the edition was first published, but that right protects the printed page layout against photocopying rather than the underlying text, so it does not reach a news aggregator's reproduction of headlines or snippets.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Malawi has no AI-specific statute, regulation, or case law imposing an AI-transparency, output-labeling, or bot-disclosure duty currently in force.
The Electronic Transactions and Cyber Security Act, 2016, the Copyright Act, 2016, and the Data Protection Act, 2024 each address electronic transactions, computer misuse, copyright, or personal data generally, and none singles out an artificial-intelligence system, an automated-decision system, or synthetic or AI-generated content for a distinct duty.
In August 2026 the government announced that the Ministry of Information and Digitalisation was drafting a National AI Strategy to underpin a National AI Bill, and the minister responsible for information and communications technology said the bill should be tabled in Parliament before the end of the year; no bill text, and no Parliament order paper or government notice recording that tabling, has been located, so no instrument is recorded for it.
As of .
Cybersecurity law
Malawi's Electronic Transactions and Cyber Security Act No. 33 of 2016 establishes the Malawi Communications Regulatory Authority's Malawi CERT (Part II, section 6) to coordinate the country's response to information and communication technology security threats, but the Act places no vulnerability, incident, or breach reporting duty on a private business toward that unit, and no operator-facing critical-infrastructure regime has been located: section 102 gives the Minister power to make regulations declaring information "critical data" and prescribing management and registration standards for a database holding it.
Part VI, headed "Security and digital economy" (sections 46 to 70), is the Act's digital-signature, encryption, and certification-authority trust framework together with cyber-inspector enforcement powers, not a product-security or sector cyber-resilience regime reaching a software or platform provider.
Section 74's "Security obligations," inside Part VII's data-protection provisions, and the standalone Data Protection Act, 2024, are this jurisdiction's privacy-topic instruments and are not repeated here. The Guidelines on Information and Cybersecurity Risk Management for Banks say they are issued pursuant to Section 96 of the Financial Services Act, 2010.
Paragraph 1.2.12 of those Guidelines says senior management of a bank shall report all information and cyber risk incidents to the Registrar immediately as and when they happen.
As of .
Age gating law
Malawi has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.
The Electronic Transactions and Cyber Security Act, 2016 prohibits child pornography in electronic form and criminalizes producing, reproducing, offering, distributing, or possessing it, or exposing a child to pornographic material through an information system, but the duty its filtering provision imposes runs to an establishment or place open to the public that provides internet access, which must use pornography-filtering software, not to an online service provider or app that publishes or hosts content; the Act therefore imposes no age-verification or age-gating duty of the kind this topic tracks.
The Child Care, Protection and Justice Act, 2010, which consolidates Malawi's child care, protection and child-justice law and defines a child by reference to the sexual and other abuse a child may suffer, was checked and contains no reference to the internet, an online service, or an electronic communication.
As of .
Case law
No current case law for Malawi AI law
No current case law for Malawi privacy law
No current case law for Malawi scraping law
No current case law for Malawi cybersecurity law
No current case law for Malawi communications law
No current case law for Malawi content moderation law
No current case law for Malawi product and AI liability law
No current case law for Malawi digital accessibility law
No current case law for Malawi age gating law
No current case law for Malawi reuse law
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
