The Malawi Communications Regulatory Authority (MACRA) is pushing forward with plans to charge data controllers and data processors annual registration fees, using a series of stakeholder consultations — most recently in Lilongwe — to defend the proposal and gather feedback before it is finalised.
MACRA, which is designated under the Data Protection Act, 2024 as the country’s Data Protection Authority, brought representatives from the private sector and other key institutions together at Capital Hotel in Lilongwe on Wednesday to discuss its Draft Data Protection Regulations, Guidelines and Proposed Registration Fees.
MACRA Head of Data Protection, Daniel Chiwoni in an interview said the aim of holding the stakeholders meeting is to give everyone the opportunity to have a say before coming with a final decision.
“Our objective is to solicit input and views from our stakeholders on the proposed registration fees for data controllers and data processors. Everyone has got a say before we come up with the final position.
“The views that we got from Blantyre was about reviewing the fees but we haven’t finished the consultation process. We will be proceedings with the same event to Mzuzu,” he said.
Chiwoni told the meeting the consultation was aimed at ensuring the new regulations strike a balance between protecting personal data, encouraging innovation and supporting economic growth.
He added that the engagement is meant to ensure the proposed fees and the wider regulatory framework are fair, practical and responsive to the needs of organisations that will have to comply.
Chiwoni explained that the proposed registration fees will let MACRA effectively monitor compliance and enforce the Data Protection Act, in turn helping to build a trusted digital economy.
The Act came into force in June 2024, replacing the data protection provisions previously contained in the Electronic Transactions and Cyber Security Act, and gave Malawians new rights over how their personal information is collected, stored, shared and transferred, including restrictions on sending data outside the country without adequate safeguards.
The Lilongwe meeting gave stakeholders a direct opportunity to question MACRA on how the proposed fees would work in practice.
United General Insurance Assistant Manager Colleta Kaira welcomed the consultation but said she needed more clarity on the structure, particularly the gaps between certain registration bands: “I have some questions because there are some jumps in the fee structure that I’m not comfortable with. I hope to get a better understanding when those questions are addressed.”
Airtel Malawi Director of Legal and Regulatory Affairs, Christopher Nkhonjera Chibwana, said the meeting was informative and well organised, but asked the Authority to be transparency on the fees structure.
“Many of us feel that MACRA should provide a more detailed explanation of how the proposed fees were determined and why annual turnover was chosen as the basis for charging. This will enable us to provide more meaningful and informed feedback,” he said.
The Lilongwe session followed an earlier workshop MACRA held in Blantyre, where the authority first set out the proposed fee structure in detail.
Under that structure, annual fees would range from K50,000 for small and medium enterprises to K7 million for larger organisations, applying to entities handling the personal data of at least 10,000 individuals.
MACRA has indicated mandatory registration is intended to take effect from 1 September 2026.
MACRA has stressed that the fee structure remains a draft and that no organisation’s final registration band has been locked in.
