Proposed registration data fees for data controllers and processors set to roll out on September 1 this year have stirred panic among local firms who argue that the charges will increase business operational costs.
The charges range from K50 000 to about K7 million per annum.
The mandatory registration fees will apply to firms or organisations that handle personal data for at least 10 000 individuals across various sectors, including education, agriculture, health and financial services.
Under the proposed fee structure, Malawi Communications Regulatory Authority (Macra) says small and medium enterprises (SMEs) will pay an annual minimum fee of K50 000 while large organisations could pay up to K7 million depending on their annual turnover and eligibility.
Speaking during a stakeholder consultation workshop organised by Macra in Blantyre yesterday, Game Haven Lodge managing director Greg Gange-Harris said while data protection regulations were important for building trust and supporting business growth, the proposed charges were too high for some companies.
“For us, we are supposed to pay about K4 million, but maybe K1.5 million would do. These regulations are critical for business development, but the fees are on the higher side,” he said.
Macra head of data protection Daniel Chiwoni said the consultation was aimed at collecting stakeholders’ views on the draft Data Protection Regulations and Guidelines and proposed registration fees before implementation.
He said the telecommunications regulator is committed to developing a consultative and evidence-based data protection regime that balances the protection of personal data with innovation, investment and economic growth.
“Effective implementation of the law requires clear regulations, practical guidance and an implementation framework that is fair, transparent and responsive to the realities faced by both the public and private sectors,” said Chiwoni.
On his part, Ministry of Information and Communications Technology Principal Secretary Harold Msusa said government wants a framework that protects citizens’ personal data without becoming a barrier to innovation, entrepreneurship and investment.
“Government appreciates Macra’s proposal to adopt a turnover-based approach, which seeks to ensure that larger organisations with greater resources contribute proportionately more than smaller entities,” he said.
The Data Protection Act of 2024 provides Malawi’s legal framework for the collection, processing, storage and sharing of personal data, with Macra designated as the Data Protection Authority responsible for enforcing compliance.
The law requires organisations handling huge amounts of personal data to meet prescribed standards and register with the authority to protect individuals’ privacy rights while promoting confidence in the country’s growing digital economy.
