Electronic Transactions and Cyber Security Act, 2016, data protection and privacy (Part VII)
Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71-74)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 June 2017.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Process personal data fairly and lawfully, collect it only for specified and legitimate purposes, and do not process it further in a way incompatible with those purposes.
- Have a lawful basis, such as the data subject's unambiguous consent, contractual necessity, or a legal obligation, before processing their personal data.
- When collecting personal data from a data subject, tell them who is responsible for the processing and the purpose of it, and that they have rights of access, rectification and objection.
- Let a data subject obtain confirmation of whether their data is being processed, access to it, and its rectification, erasure or blocking where the processing does not comply with the Act.
- Implement technical and organizational security measures appropriate to the risk to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Part VII states no penalty of its own; a breach falls to section 95's general default offence, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision of the Act whose penalty is not otherwise stated.
Penalty structure
The Act's general default penalty (s. 95), applied because Part VII states no penalty of its own; also carries imprisonment of up to seven years.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- MWK
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Malawi Communications Regulatory Authority
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 71 requires a data controller to ensure personal data is processed fairly and legally, collected for specified, explicit and legitimate purposes and not further processed incompatibly with those purposes, kept adequate, relevant and not excessive, accurate and up to date, and kept in identifiable form no longer than necessary; personal data may be processed only where the data subject has unambiguously consented, where processing is necessary for a contract with the data subject, for compliance with a legal obligation, or on other grounds the section lists.
Section 72 entitles a data subject to obtain from a data controller, without constraint or unreasonable delay and at no expense, confirmation of whether data about him is being processed, communication of the data undergoing processing, and the rectification, erasure or blocking of data whose processing does not comply with the Act.
Section 73 requires a data controller, when collecting data from a data subject, to give him the identity of the controller, the purpose of the processing, and the existence of the rights of access, rectification and objection.
Section 74 requires a data controller to implement technical and organizational measures to protect personal data against accidental or unlawful destruction or loss, alteration, unauthorized disclosure or access, and other unlawful processing, at a level appropriate to the risks.
Part VII states no penalty of its own; a breach falls to the Act's general default offence at section 95, a fine of K5,000,000 and imprisonment for seven years for a violation of any provision whose penalty is not otherwise stated. Part VII does not address transfer of personal data outside Malawi and sets no distinct breach-notification duty to a regulator or to the data subject.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
official consolidated Act text, Malawi Legal Information Institute (MalawiLII)