Malawi's Data Protection Act-Highlights

The Malawi Data Protection Act of 2024 establishes a comprehensive framework to safeguard personal data and regulate its processing. Here are the key highlights:

1. Data Subject Rights: Individuals have the right to access their data, request corrections, object to data processing, request data portability, and request the erasure of their data under certain conditions.
2. Sensitive Personal Data: The Act provides heightened protection for sensitive personal data, including biometric data, health information, racial or ethnic origin, religious beliefs, political opinions, and more. Processing such data typically requires explicit consent from the data subject.
3. Data Security and Breach Notification: Organizations are required to implement robust security measures to protect personal data. In the event of a data breach, organizations must notify both the Malawi Communications Regulatory Authority (MACRA) and the affected individuals within 72 hours.
4. Data Protection Officer (DPO): Entities involved in large-scale processing of personal data, or those handling sensitive data, must appoint a Data Protection Officer to ensure compliance with the Act.
5. Cross-Border Data Transfers: Transfers of personal data outside Malawi are restricted and can only occur if the destination country provides adequate data protection or under specific exceptions, such as the data subject's consent.
6. Registration with MACRA: Data controllers and processors handling significant amounts of personal data must register with MACRA, which will oversee their compliance with the Act.
7. Penalties for Non-Compliance: The Act outlines stringent penalties for non-compliance, including fines and imprisonment for serious violations.

These provisions are designed to protect individuals' privacy and align Malawi's data protection standards with international best practices.