Malawi
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Malawi has undergone significant legislative modernisation. The Data Protection Act 2024 entered into force on 3 June 2024 (replacing data protection provisions in Part IV of the Electronic Transactions and Cyber Security Act No. 33 of 2016) and is enforced by MACRA (Malawi Communications Regulatory Authority). The Electronic Transactions and Cyber Security Act 2016 remains in force for cybercrime provisions; s.84 criminalises unauthorised access to, or interception of, or interference with data. Malawi is a common-law jurisdiction. No sui generis database right exists. No TDM exception. The DPA 2024 is new and enforcement practice is still developing, making this record fast-moving. Public-page crawling of non-personal data is low risk; personal-data collection requires a lawful basis; technical circumvention carries criminal exposure.
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | without permission |
| Public-page carve-out | unsettled |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | fair dealing narrow |
| Text and data mining — commercial status | unsettled |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | Data Protection Act 2024 (MACRA — Malawi Communications Regulatory Authority) |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-23. Confidence: medium. Fast-moving area — verify before relying. Not legal advice.