MACRA consults stakeholders on proposed data protection registration fees

The Malawi Communications Regulatory Authority (MACRA), acting as the country's designated Data Protection Authority (DPA), has initiated stakeholder consultations on draft data protection regulations, with a particular focus on proposed registration fees for data controllers and processors. These consultations, held in Lilongwe and Blantyre, are a critical step in operationalising Malawi's Data Protection Act, 2024, which came into force on June 3, 2024. The proposed annual fees, ranging from K50,000 to K7 million based on an organisation's annual turnover, are intended for entities handling personal data of at least 10,000 individuals. While MACRA aims to balance data protection with economic growth, some stakeholders have voiced concerns regarding the high charges, prompting the DPA to consider revisions before the fees become mandatory on September 1, 2026.

Malawi is rapidly advancing its data protection framework with the Malawi Communications Regulatory Authority (MACRA), in its capacity as the designated Data Protection Authority (DPA), actively engaging stakeholders on the proposed data protection regulations. A recent consultation meeting held in Lilongwe on Wednesday, July 15, 2026, focused specifically on the contentious issue of registration fees for data controllers and data processors. This engagement marks a crucial phase in the implementation of the Data Protection Act, 2024, which seeks to establish a robust legal environment for safeguarding personal data in the digital age.

The foundation for Malawi's data protection regime was laid with the enactment of the Data Protection Act, 2024 (the Act), which officially came into force on June 3, 2024. This landmark legislation repeals the data protection provisions previously contained within the Electronic Transactions and Cyber Security Act, 2016, and establishes a comprehensive framework for the processing, storage, and sharing of personal data. The Act designates MACRA as the national Data Protection Authority, entrusting it with the mandate to oversee its implementation and enforcement. The DPA is empowered to investigate complaints, conduct audits, and impose fines for non-compliance, ensuring that organisations adhere to principles such as lawfulness, fairness, transparency, and data minimisation.

The ongoing stakeholder consultations by MACRA are a direct consequence of the Data Protection Act, 2024, which mandates the registration of data controllers and processors deemed to be of significant importance. The draft regulations propose an annual registration fee structure, which has become a central point of discussion. Under these proposals, fees would be determined by an organisation's annual turnover, ranging from a minimum of K50,000 to a maximum of K7 million. This turnover-based approach is designed to ensure that larger entities contribute proportionately, thereby preventing undue financial burdens on smaller businesses. The mandatory registration is specifically targeted at firms or organisations that handle the personal data of at least 10,000 individuals across various sectors.

While the government, through the Ministry of Information and Communication Technology, has reiterated its commitment to a transparent and inclusive data protection regime that balances privacy with business growth, the proposed fees have elicited mixed reactions. During the consultation in Lilongwe, stakeholders from the private sector, including representatives like Colleta Kaira from United General Insurance, highlighted the importance of data protection but also expressed concerns about the financial implications of the proposed charges, suggesting a need for revision to better suit the business community. Similarly, a consultation in Blantyre also saw businesses raising concerns about the high costs.

MACRA's Head of Data Protection, Daniel Chiwoni, acknowledged these concerns, stating that the consultations are intended to gather diverse views and ensure the final regulations strike an appropriate balance between protecting personal data, fostering innovation, and supporting economic growth. The DPA has also indicated that it has developed an implementation framework to guide compliance, aiming for a fair, transparent, and responsive regulatory environment. The consultative approach, while potentially delaying the finalisation of the regulations, is crucial for fostering buy-in and ensuring the long-term viability and effectiveness of Malawi's data protection framework.

The ongoing consultations by MACRA on the proposed data protection registration fees represent a critical juncture for businesses and legal professionals operating in Malawi. With the Data Protection Act, 2024, now in force and mandatory registration fees slated to commence on September 1, 2026, data controllers and processors must closely monitor the finalisation of these regulations. Practitioners should advise clients to actively engage with the DPA's processes, where possible, and to begin assessing their data processing activities to determine their classification under the Act and the potential financial implications of the proposed fees. The DPA's willingness to consider stakeholder feedback suggests that the final fee structure may yet be adjusted, making continued vigilance and proactive compliance planning essential. The ultimate goal remains a robust data protection ecosystem that safeguards individual privacy without stifling economic development.