Law: Data protection provisions are included in the Constitution of Malawi (the Constitution), in the Electronic Transactions and Cyber Security Act, 2016 (the Act), and in the Data Protection Bill, 2021 (the Bill)

Regulator: Malawi Communications Regulatory Authority (MACRA)

Summary: Currently, there is no general data protection law in Malawi. However, the Data Protection Bill, 2021 (the Bill) was published for public comment in early 2021. The Bill would repeal the data protection provisions in the Electronic Transactions and Cyber Security Act, 2016 (the Act) and designate the Malawi Communications Regulatory Authority (MACRA) as the authority which would regulate personal data protection in Malawi. On the other hand, the Constitution of Malawi (the Constitution) provides for the right to privacy, and sectoral laws include provisions regarding data protection. For instance, the Act provides principles governing the processing of personal data, legal bases for the processing activities, data subjects' rights, and security measures that a controller must put in place when processing personal data.