What Is Data Protection Act, 2024 (No. 3)?
Malawi's Data Protection Act, 2024 (No. 3) establishes rights for natural persons over personal-data processing and designates the Malawi Communications Regulatory Authority (MACRA) as the statutory Data Protection Authority (DPA). Government Notice No. 40 of 2024 fixed 3 June 2024 as the date the Act came into operation. The Act provides access and portability within 30 days, rectification within 14 days, and erasure without undue delay on listed grounds (data no longer necessary, withdrawn consent with no other legal ground, a successful objection, unlawful processing, or a legal obligation to erase). Objection to processing generally requires likely substantial and unwarranted damage or distress; a separate direct-marketing objection is not subject to that condition. The DPA's Complaints and Investigations Regulations, 2025 supplement the complaint process. This page is a source-backed evidence profile, not legal advice. No Malawi-specific data-broker or people-search opt-out route was located; the documented general route is a request to the controller/processor followed, if unresolved, by a written complaint to the DPA.
At a glance
- Full name
- Data Protection Act, 2024 (No. 3)
- Short code
- Malawi DPA 2024
- Jurisdiction
- Malawi
- Enacted
- 2024
- Last major update
- Came into operation 3 June 2024 per Government Notice No. 40 of 2024; no later amending Act located in the 9 October 2026 review
- Regulator
- Data Protection Authority (DPA), designated to the Malawi Communications Regulatory Authority (MACRA)
- Private right of action
- Limited
- Statutory citation
- Data Protection Act, 2024 (No. 3 of 2024)
Scope, who Malawi DPA 2024 covers
Protected data
Data subject rights
Access and confirmation of processing, with a copy in a commonly used electronic format within 30 days (sections 19–20)
Data portability in a structured, machine-readable format within 30 days for qualifying cases (section 20)
Rectification of errors and completion of incomplete data within 14 days (section 21)
Erasure without undue delay on listed statutory grounds (section 22)
Restriction of processing where accuracy is contested or the data is no longer needed for its purpose (section 23)
Objection to processing causing substantial and unwarranted damage/distress, and a separate objection to direct marketing (sections 24–25)
Notable features
The DPA publishes a complaint form and contact address (info@dpa.mw, Lilongwe) and requires complaints within 90 days of the action or inaction. The Data Protection (Complaints and Investigations) Regulations 2025 and registration requirements are current supplementary instruments.
Enforcement & penalties
Penalties: The reviewed official sources (Act text, DPA complaint and contact pages) did not specify administrative or criminal penalty amounts for this research pass; check the consolidated Act and DPA guidance separately before publishing a penalty figure.
Private right of action: The Act channels complaints to the DPA (written complaint, investigation, and a result communicated within 30 days of completing the investigation), rather than describing a standalone civil damages action in the sources reviewed.
Relevance to data brokers
No Malawi-specific data-broker registry or people-search opt-out route was located. A broker or other controller processing personal data in Malawi is reachable through the general controller request and DPA complaint route described above; whether a particular broker falls within scope requires entity-specific review.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
When did Malawi’s Data Protection Act take effect?+
Government Notice No. 40 of 2024 fixed 3 June 2024 as the date the Act came into operation.
How do I complain if a company in Malawi will not honor my rights request?+
Malawi’s DPA accepts written complaints (including anonymous ones) within 90 days of the action or inaction, by post or email to info@dpa.mw, and investigates within 30 days of completing its investigation.
Official sources & citations
Other international privacy regimes
Malawi DPA 2024 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: