Malawi to enforce mandatory data protection fees from September

The Malawi Communications Regulatory Authority (Macra) says mandatory registration fees for data controllers and processors will take effect on 1 September 2026, as the country moves to enforce the Data Protection Act of 2024.

The annual fees, ranging from K50,000 for small and medium enterprises to K7 million for larger organisations, will apply to entities handling the personal data of at least 10,000 individuals.

Speaking during a stakeholder consultation workshop organised by Macra in Blantyre, the authority’s head of data protection, Daniel Chiwoni, said it had developed a framework to guide implementation of the new requirements while balancing data privacy, innovation and investment.

Ministry of Information and Communication Technology Principal Secretary Harold Msusa said the turnover-based fee structure would ensure larger organisations contribute more, without creating barriers for smaller players.