No. 3 3 Data Protection sectIOn Part IX—cOMPLaInts 44. complaints 45. compliance orders 46. 47. 48. 49. 50. 51. 52. 53. Part X—MIsceLLaneOus appeal against decisions of the authority civil remedies Obstruction, interference with the authority Breach of confidentiality Offences committed by legal persons, firms, etc. Vicarious liability regulations transitional provision An Act to provide for the protection of personal data of natural persons; the regulation of the processing and movement of personal data of natural persons; the rights of natural persons with respect to the processing of personal data; the obligations of data controllers and data processors; the designation of a Data Protection Authority; and matters incidental thereto enacteD by the Parliament of Malawi as follows— Part I—PreLIMInary 1. this act may be cited as the Data Protection act, 2024, and shall come into operation on such date as the Minister may appoint by notice published in the Gazette. 2. In this act, unless the context otherwise requires— “authority” means the Malawi communications regulatory authority established under section 4 of the communications act; “binding corporate rules” means personal data protection policies which are adhered to by a data controller or data processor or a group of data controllers or data processors engaged in joint economic activity, for a transfer or a set of transfers of personal data to a data controller or data processor outside Malawi; “biometric data” means personal data resulting from technical processing relating to the physical, physiological or behavioural characteristics of a natural person which confirms the unique identification of that person, and includes, a physical short title and commencement Interpretation cap. 68:01