MACRA Data Protection Regulations: 7 Major Changes Proposed for Malawi

MACRA Data Protection Regulations: Malawi Consults Stakeholders on New Privacy Rules

MACRA Data Protection Regulations are at the centre of a new stakeholder consultation launched by the Malawi Communications Regulatory Authority (MACRA) to strengthen the country’s privacy and data governance framework.

Held at Mount Soche Hotel in Blantyre, the consultation brought together representatives from government, businesses and other institutions to discuss proposed regulations that will govern significant data controllers and data processors before the rules are finalised.

MACRA Data Protection Regulations propose turnover-based registration fees

One of the major proposals under the draft regulations is a new annual registration fee structure for organisations classified as significant data controllers and processors.

The proposed fees will be based on annual turnover and range from K50,000 for smaller organisations to K7 million for larger entities.

Government officials say the approach ensures larger organisations contribute more while protecting small businesses from excessive compliance costs.

Government aims for a balanced data protection framework

Speaking during the consultation, officials from the Ministry of Information and Communication Technology reaffirmed the government’s commitment to creating a modern and inclusive data protection system.

The ministry said the regulations are intended to protect citizens’ personal information while also supporting business growth, innovation and digital transformation.

Officials noted that the proposed framework seeks to strike the right balance between regulatory oversight and economic development.

MACRA develops implementation framework

MACRA has also developed an implementation framework that will guide organisations in complying with the new requirements once the regulations take effect.

According to the Authority, the framework is designed to:

• Improve compliance with data protection laws
• Protect personal information
• Support innovation
• Promote responsible data governance
• Strengthen public confidence in digital services

The consultation process allows businesses and other stakeholders to provide input before the regulations are formally adopted.

Stronger privacy protections for Malawi’s digital economy

The proposed regulations come as Malawi continues expanding digital services across multiple sectors.

With increasing adoption of:

• Online financial services
• Digital identity systems
• E-government platforms
• Artificial intelligence
• Digital commerce

the volume of personal data being processed continues to grow.

Authorities believe stronger regulation will improve accountability, reduce cybersecurity risks and enhance trust in digital platforms.

Why the consultation matters

The stakeholder engagement is an important step toward finalising regulations that reflect the needs of both businesses and citizens.

MACRA said collecting feedback from organisations that handle personal information will help ensure the final rules are practical, transparent and effective.

Once approved, the regulations will establish clearer obligations for significant data controllers and processors while strengthening Malawi’s overall data protection framework.

What the proposed regulations mean

If adopted, the new regulations will require certain organisations to register with MACRA based on their annual turnover, comply with enhanced data protection obligations and follow implementation guidelines developed by the Authority.

The framework is expected to improve privacy governance while supporting Malawi’s broader digital economy ambitions.

---

Frequently Asked Questions (FAQ)

What are the MACRA Data Protection Regulations?

The MACRA Data Protection Regulations are proposed rules designed to strengthen Malawi’s data protection framework and regulate organisations that collect and process personal data.

Why is MACRA consulting stakeholders?

MACRA is gathering feedback from businesses, government institutions and other stakeholders before finalising the regulations.

How will registration fees be calculated?

The proposed fees will be based on an organisation’s annual turnover, ranging from K50,000 to K7 million depending on the size of the organisation.

Who will need to register?

The regulations will apply to data controllers and data processors considered to be of significant importance under Malawi’s Data Protection Act.

Why are the new regulations important?

The regulations aim to improve data privacy, strengthen cybersecurity, increase public trust in digital services and support responsible innovation as Malawi’s digital economy continues to grow.

Read More: Privacy and Data Protection