Mali is a party to the Patent Cooperation Treaty (PCT).

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is USD 60, below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

The law in Malawi provides for local presence requirements for payment systems operators. Section 14 of the Payment Systems Act requires all systems operators (i.e. non-bank financial institutions, mobile payment system operators, remittance service providers, card issuers, or other persons as licensed or authorised by the Reserve Bank) to have a registered office in the country.

The Electronic Transactions and Cybersecurity Act of 2016 provides a comprehensive consumer protection framework that applies to online transactions. Consumer protection for online purchases is provided in Part V of the Act of 2016. Among others, the Act binds the supplier to deliver the goods or to provide the services immediately upon conclusion of the contract; mandates the supplier to make available security procedures and privacy policy in respect of payment, payment information, and personal information of the consumer; and gives rights to the consumer to withdrawal from a contract concluded by electronic means without giving reasons and without penalties.

Malawi has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Malawi has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Malawi has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to Section 52-53 of the Electronic Transactions and CyberSecurity Act of 2016, cryptography services or products are required to be registered by the Communications Authority. Additionally, the use, importation, and exportation of encryption programs and encryption products are subject to authorisation by the government.

Section 96 of the Communications Act requires a licensee to use approved types of equipment for connection to an electronic network. The Communications Authority may, at the request of any licensee, manufacturer or supplier of equipment, conduct type approval tests and issue type approval certificates with respect to electronic communications equipment intended for use in Malawi. The Communication (Type Approval) Regulations, which provides for a list of approved, prohibited and exempted electronic equipment, is, however, in draft form, presently at the consultation stage.

Sections 52 and 53 of the Electronic Transactions and Cybersecurity Act of 2016 require cryptography services or products to be registered with the Communications Authority. Furthermore, the use, importation, and exportation of encryption programs and products are subject to government authorisation. Section 67 of the Act mandates that encryption service providers disclose the technical characteristics of their encryption methods and the source code of the software used to the Authority. Non-compliance with these regulations constitutes a criminal offence, punishable by imprisonment and a fine.

According to Section 18 of Payment Systems (E-money) Regulations, the Reserve Bank shall prescribe limits on transaction values and balance limits on e-money accounts for individual subscribers and agents. E-money accounts for corporate bodies shall be exempted from transaction and balance limits. In addition, for purposes of the Regulation, 'transaction limits' are established as the limits for the total value of transactions originating from a mobile money account and involving a transfer of e-value out of that account. According to the second annexe of the regulations, the maximum transaction limits are:
- K750,000.00 (approx. USD 737) per day for personal subscriber accounts;
- K20,000,000.00 (approx. USD 19,700) per day for agents; or
- K100,000,000.00 (approx. USD 98,300) per day for merchants.
In addition, the account balance limits are:
- K1,000,000.00 (approx. USD 980) on personal subscriber accounts;
- K25,000,000.00 (approx. USD 24,600) on agent accounts; or
- K100,000,000.00 (approx. USD 98,300) for merchants.

Section 12.4 of the Malawi National Health Information System Policy provides a requirement for any health-related data, whether physical or electronic, to be stored only within the borders of Malawi except for the purpose of continuation of care. Section 14.1 ascribes ownership of any health-related data to the Ministry of Health. This policy was elaborated for the health sector of Malawi, i.e. public and private. The stipulations therein, therefore, apply to all public and private health facilities alike (Section 2).

Section 38 of Malawi’s Data Protection Act prohibits the transfer of personal data from Malawi to another country or international organisation unless the recipient is subject to a legal or institutional framework that ensures an adequate level of protection. This includes laws, binding corporate rules, contractual clauses, codes of conduct, or certification mechanisms. Under Section 39, the Malawi Communications Regulatory Authority is empowered to assess adequacy, either on its own initiative or upon application. The assessment considers factors such as the enforceability of data subject rights, respect for the rule of law and human rights, the existence of effective data protection legislation, independent supervisory authorities, and relevant international commitments. Where adequacy is not established, Section 39(4) permits transfers only under specific conditions, such as explicit informed consent, contractual necessity, or where the transfer is clearly in the interest of the data subject and obtaining consent is impracticable. Section 40 requires that any adopted binding corporate rules, codes of conduct, or certification mechanisms be submitted to the Authority.

Malawi has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Data Protection Act establishes a comprehensive regime for data protection in Malawi. It repeals the data protection provisions contained in the Electronic Transactions and Cyber Security Act, 2016, and designates the Malawi Communications Regulatory Authority (MACRA) as the national data protection authority. The Act applies to the processing of personal data within Malawi, including by entities outside the country that offer goods or services to, or monitor the behaviour of, individuals in Malawi. It excludes processing undertaken solely for personal or household purposes, as well as the mere transmission of data through Malawi. The Act imposes obligations on data controllers and processors, including mandatory registration for those of significant importance. These entities are required to comply with the Act within six months of its commencement, while others are granted a 24-month grace period. MACRA is empowered to investigate potential or actual violations of the Act.