DATA PROTECTION

CHAPTER 74:04
DATA PROTECTION

ARRANGEMENT OF SECTIONS

    SECTION

PART I
PRELIMINARY

    1.    Short title

    2.    Interpretation

    3.    Application

PART II
ADMINISTRATION

    4.    Designation of Data Protection Authority

    5.    Functions of the Authority

    6.    Powers of the Authority

    7.    Advisory committees

PART III
PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA

    8.    Personal data to be processed lawfully, fairly, etc.

    9.    Purpose limitation

    10.    Data minimization

    11.    Data accuracy

    12.    Storage limitation

    13.    Data integrity and data confidentiality

    14.    Principles for determining the validity of consent

    15.    Provision of information to a data subject

    16.    Processing of sensitive personal data

    17.    Processing personal data of children and other legally incapacitated persons

    18.    Processing of personal data relating to criminal offences, convictions, etc.

PART IV
RIGHTS OF A DATA SUBJECT

    19.    Right to access personal data

    20.    Right to data portability

    21.    Right to rectification of personal data

    22.    Right to erasure of personal data

    23.    Right to restriction of processing personal data

    24.    Right to object

    25.    Automated decision-making

    26.    Derogations

PART V
DUTIES OF A DATA CONTROLLER AND DATA PROCESSOR

    27.    Adherence to data protection principles

    28.    Technical and organizational measures

    29.    Record of personal data processing activities

    30.    Data protection impact assessment

    31.    Joint data controllers

    32.    Regulation of the relationship between data controllers and data processors

    33.    Designation of a data protection officer

    34.    Duties of a data protection officer

PART VI
DATA SECURITY

    35.    Security of personal data

    36.    Notification of personal data breach

    37.    Communication of personal data breach to data subjects

PART VII
CROSS-BORDER TRANSFERS OF PERSONAL DATA

    38.    Cross-border transfer of personal data

    39.    Adequacy of protection of personal data

    40.    Binding corporate rules, certification mechanisms, etc.

PART VIII
REGISTRATION OF DATA CONTROLLERS OF SIGNIFICANT IMPORTANCE AND DATA PROCESSORS OF SIGNIFICANT IMPORTANCE

    41.    Registration of data controllers of significant importance and data processors of significant importance

    42.    Suspension or cancellation of registration

    43.    Exemptions

PART IX
COMPLAINTS

    44.    Complaints

    45.    Compliance orders

PART X
MISCELLANEOUS

    46.    Appeal against decisions of the Authority

    47.    Civil remedies

    48.    Obstruction, interference with the Authority

    49.    Breach of confidentiality

    50.    Offences committed by legal persons, firms, etc.

    51.    Vicarious liability

    52.    Regulations

    53.    Transitional provision

3 of 2024
G.N. 40/2024

    An Act to provide for the protection of personal data of natural persons; the regulation of the processing and movement of personal data of natural persons; the rights of natural persons with respect to the processing of personal data; the obligations of data controllers and data processors; the designation of a Data Protection Authority; and matters incidental thereto

PART I
PRELIMINARY

1.    Short title

    This Act may be cited as the Data Protection Act.

2.    Interpretation

    In this Act, unless the context otherwise requires—

    “Authority” means the Malawi Communications Regulatory Authority established under section 4 of the Communications Act;

    “binding corporate rules” means personal data protection policies which are adhered to by a data controller or data processor or a group of data controllers or data processors engaged in joint economic activity, for a transfer or a set of transfers of personal data to a data controller or data processor outside Malawi;

    “biometric data” means personal data resulting from technical processing relating to the physical, physiological or behavioural characteristics of a natural person which confirms the unique identification of that person, and includes, a physical measurement, facial image, blood type, fingerprint, retinal scan, voice recognition and deoxyribonucleic acid analysis;

    “certification mechanism” means certification of personal data protection policies and procedures in accordance with internationally recognized standards, by an official authority or professional third-party entity;

    “child” means a person below the age of eighteen years;

    “consent” means specific, informed and unambiguous agreement or approval by a natural person, given freely, in writing, orally or by any affirmative action, to a data controller or data processor to process personal data relating to that person or to another natural person on whose behalf the person has the authority to provide the consent;

    “data controller” means a natural or legal person who, alone or jointly with another natural or legal person, determines the purpose and means of processing personal data;

    “data controller of significant importance” means a data controller who—

    (a)    is domiciled, ordinarily resident, or ordinarily operates in Malawi and processes or intends to process personal data of more than ten thousand data subjects who are resident in Malawi; or

    (b)    processes or intends to process personal data…