Surveillance, privacy, and civil society: The struggle for digital rights in Malawi

 Jimmy Kainja
 BSc MRes Media & Communication (London Metropolitan
 Senior lecturer, University of Malawi
 https://orcid.org/0000-0002-7036-3144
 jkainja@unima

 Edition: AHRLJ Volume 25 No 2 2025
 Pages: 464 - 484
 Citation: J Kainja ‘Surveillance, privacy, and civil society: The struggle for digital rights in Malawi’ (2025) 25 African Human Rights Law Journal 464-484
 http://dx.doi.org/10.17159/1996-2096/2025/v25n2a18
 Download article in PDF

Summary

Malawi has recently introduced significant legal reforms, including the Data Protection Act (2024) and the establishment of a Data Protection Authority (2025), to safeguard citizens’ digital rights. While these measures provide an essential foundation for data governance, their enforcement remains weak, and surveillance practices, such as social media monitoring and mandatory SIM registration, continue under broad legal exemptions. This article explores the relationship between communication surveillance, data protection and human rights in Malawi, with a focus on the role of civil society organisations in translating statutory guarantees into practical protections. Drawing on civil society theory and qualitative data from secondary sources and key informant interviews, the study finds that CSO engagement in digital rights remains limited due to technical knowledge gaps, funding constraints, political sensitivities, and the perception of digital rights as secondary or elitist. However, rising concerns over misinformation, cyber harassment and privacy violations present opportunities for stronger advocacy. The article argues that an empowered and well-resourced civil society is essential for ensuring transparency, accountability and the practical implementation of Malawi’s data protection framework in the digital age.

Key words: data protection; digital rights; communication surveillance; civil society organisations; human rights; Malawi

1 Introduction

In recent years, Malawi has made notable progress in safeguarding digital rights, primarily through the enactment of the Data Protection Act (2024) and the creation of a Data Protection Authority in 2025. These legal initiatives demonstrate the government’s commitment to protecting citizens’ privacy and regulating the collection, storage and use of personal data. However, their practical implementation remains inconsistent, and public awareness and accountability mechanisms are still weak. Surveillance of communication, particularly on social media platforms, continues to grow, driven by state investments in interception technologies and broad legal exemptions. Civil society organisations (CSOs) have begun to advocate digital rights, but their efforts remain limited, disjointed and lack significant impact. 

While statutory legal frameworks provide a foundation for data governance, they are insufficient on their own to prevent human rights violations online. This emphasises the vital role of civil society as a mediator between law and practice, fostering oversight, advocacy and public education to ensure that legal protections lead to tangible outcomes. Drawing on civil society theory, which emphasises the role of voluntary associations in shaping democratic governance and fostering socio-political cohesion, and key informant interviews with members of civil society, this article examines the relationship between communication surveillance, data protection and human rights in Malawi. It argues that although civil society engagement on digital rights issues remains muted and limited in scope, CSOs can play a critical role in translating legal frameworks into adequate protections. The article highlights the crucial role of civil society in promoting digital rights and accountability in contemporary Malawi.

Specifically, the article aims to address the following questions:

(1) What is the relationship between communication surveillance, data protection, and human rights in Malawi, and how do recent legal developments address these issues?

(2) To what extent are civil society organisations engaging with digital rights and data protection, and what factors limit their involvement?

(3) What strategies can civil society adopt to promote the effective implementation of the Data Protection Act and ensure transparency and accountability in surveillance practices?

2 Literature review

The evolution of communication surveillance in Malawi underscores the tension between state security objectives and citizens’ right to privacy. In 2011, Malawian media reported that Alick Kimu, a mobile phone subscriber, sued the Malawi Communications Regulatory Authority (MACRA), the country’s telecommunications regulator, over the procurement of the Consolidated ICT Regulatory Management System (CIRMS), designed for lawful interception of communications, internet monitoring, global system for mobile communications (GSM) and code division multiple access (CDMA) interception, and equipment identity registry.1 The High Court ruled in favour of Kimu, citing the regulator’s potential for abuse.2 3 Kainja observed that mobile phone companies heightened concerns about privacy to garner public support, particularly among Malawians wary of state monitoring under the unpopular presidency of Bingu wa Mutharika.

Despite this opposition, later initiatives such as the national digital identification programme (2017) and mandatory SIM card registration (2018) were implemented with minimal civil society resistance, even as mobile phones became primary tools for accessing social media, mobile banking and global positioning system (GPS)-enabled services, giving the government potentially extensive means of monitoring citizens, thus validating the concerns initially highlighted by CIRMS.

The muted response of civil society to data centralisation and surveillance in Malawi reflects deeper structural constraints common among CSOs in developing countries. The World Bank broadly defines civil society as including non-governmental oganisations (NGOs), community groups, labour unions, faith-based organisations and professional associations.4 Across Africa, surveillance practices usually target political opponents, journalists, activists and, occasionally, low-level criminals, reinforcing unequal power relations between the state and its citizens. Despite this, there is a paucity of academic research on the reasons behind Malawian civil society’s limited resistance to the centralisation of personal data or the growing surveillance infrastructure. This lack of opposition is especially concerning given the increasing sophistication of communication surveillance and its potential to undermine privacy, civil liberties and democratic freedoms.

Privacy International defines communication surveillance as the monitoring, interception, collection, preservation and retention of information communicated over networks by a third party.5 Ilori distinguishes between lawful and unlawful interception of communication, noting that lawful interception is justified when it serves to protect public safety, prevent crime or facilitate cross-border cooperation.6 Macnish points out that surveillance is inevitable to some extent, as it supports governance, welfare and public administration functions.7 However, the widespread use of surveillance to target dissidents or specific groups raises significant human rights concerns. Duncan and Greenwald emphasise that surveillance undermines freedom of expression, self-determination and privacy, often encouraging conformity and self-censorship among citizens.8 9 Advances in information and communication technologies have increased state capacity for communication, enabling automated, indiscriminate and suspicion-free surveillance on an unprecedented scale.

The 2021 State of Internet Freedom in Africa report by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) documented the expanding use of state surveillance through spyware, drones, social media monitoring, mobile phone location tracking and video surveillance.10 Countries such as Malawi, Chad, Senegal, Tanzania and Zambia have enacted laws regulating encryption, often requiring service providers to decrypt information for lawful interception. Despite constitutional and international safeguards for privacy, African governments continue to collect and process personal data without adequate oversight or remedies, arguing that surveillance is necessary to prevent crime and terrorism.11 This imbalance highlights the persistent risk of abuse inherent in secretive surveillance systems and the limited capacity of civil society to hold states accountable, reinforcing the need for stronger oversight, transparency and advocacy mechanisms in countries such as Malawi.

3 Theoretical framework

This article employs civil society theory, which offers a critical perspective for analysing the role of non-state actors in shaping governance, especially in contexts where state institutions are weak or involved in rights violations.12 In the realm of digital rights, CSOs serve as essential agents of advocacy, oversight and public education, particularly when legal frameworks are poorly enforced. Civil society comprises a diverse range of organisations and movements operating independently of the state and market, including NGOs, community groups and advocacy networks. These entities are vital in advancing human rights and democratic governance, especially in environments where state accountability is limited.

In the context of digital rights, CSOs engage in several key activities. They participate actively in policy dialogues, advocating the incorporation of human rights principles into digital governance frameworks. For instance, civil society groups have called for more inclusive legislative reform processes, particularly through meaningful public consultations, to ensure that digital governance adheres to human rights standards. CSOs also collaborate with organisations such as the Malawi Human Rights Commission to monitor digital rights, ensuring that government actions align with constitutional and international human rights obligations.

Additionally, they play a crucial role in public education and capacity building by conducting training workshops, launching awareness campaigns and providing resources to help individuals navigate the digital environment responsibly. When civic space diminishes, CSOs often engage in innovative forms of resistance to defend democratic values. Initiatives such as the Hivos ‘Connect, defend, act!’ project aim to protect civic space and empower civil society in challenging contexts, including Malawi.13

Several theoretical frameworks underscore the importance of civil society in digital rights advocacy. The Habermasian Public Sphere theory posits that a vibrant public sphere, where individuals can freely exchange ideas, is essential for democratic governance; CSOs facilitate this by providing platforms for public discourse on digital rights issues. Similarly, deliberative democracy emphasises that democratic legitimacy arises from public reasoning and deliberation, to which CSOs contribute by engaging citizens in discussions about digital policies and practices. The human rights-based approach further highlights that human rights should be central to all aspects of governance, including digital governance, with CSOs advocating the integration of human rights principles into policy and practice to ensure that individual rights are protected. In Malawi, the enactment of the Data Protection Act (2024)14 and the establishment of the Data Protection Authority represent essential steps towards safeguarding digital rights. However, the practical implementation of these legal frameworks remains inconsistent, leading to accountability gaps. CSOs play a vital role in closing these gaps by advocating stricter enforcement, holding both state and corporate actors accountable for privacy breaches, and offering legal and technical expertise to guide policy development and help individuals understand and assert their digital rights. Through public campaigns and educational initiatives, CSOs also raise awareness about digital rights, empowering citizens to protect their online privacy and freedoms.

Therefore, the civil society theory offers a strong framework for understanding the crucial role of non-state actors in promoting and defending digital rights. In Malawi, where legal protections are in place but enforcement remains limited, CSOs are vital in turning statutory assurances into tangible safeguards for individuals’ digital rights.

4 Methodology

This article adopts a qualitative research approach, primarily relying on the analysis of secondary data. It draws from a wide range of existing sources, including academic literature, policy reports, legislative documents, civil society publications and media reports, to examine the relationship between communication surveillance, data protection and human rights in Malawi. These sources offer valuable contextual and historical insights into the evolution of digital governance, the development of data protection laws, and the role of civil society in advancing digital rights. To supplement the secondary data, the study also incorporates key informant interviews with seven members of CSOs in Malawi who are knowledgeable about digital rights issues. Ethical standards were upheld throughout the research process. All participants were provided with an informed consent document detailing the purpose of the study, their rights to anonymity and withdrawal, and the intended use of the data.

This approach is well suited for addressing the three research questions. The first question, which investigates the relationship between communication surveillance, data protection and human rights, demands a comprehensive understanding of legal, policy and historical contexts. Analysing secondary sources, such as academic literature, policy reports, legislative documents and civil society publications, offers essential insights into the development of digital governance in Malawi and the normative frameworks that support privacy and surveillance. These sources lay a foundation for recognising structural patterns and gaps in current protections.

The second question, which explores the extent and boundaries of civil society engagement, requires both documented evidence and experiential insights. While secondary data highlights advocacy trends and institutional roles, it often misses the nuanced understanding of practical challenges and organisational priorities. To address this gap, the study includes interviews with seven civil society actors who are actively involved in digital rights work. These interviews provide context-specific insights into capacity limitations, funding issues and political sensitivities that influence engagement, thereby enriching the analysis derived from secondary data.

Finally, the third question on strategies for strengthening implementation, transparency and accountability in digital governance benefits from this dual approach. Secondary data ensures that recommendations are grounded in current legal frameworks and international best practices, while interviews gather forward-looking ideas from practitioners. Combining both methods improves the robustness of the findings through triangulation, providing a comprehensive analysis that reflects both structural realities and lived experiences.

5 Legal and policy context in Malawi

Malawi’s legal framework for digital rights has undergone significant reforms in recent years, particularly with the enactment of the Data Protection Act (2024)15 and the establishment of a Data Protection Authority in 2025. These measures represent a significant step towards safeguarding citizens’ privacy and regulating the collection, processing and storage of personal data. The Data Protection Act introduces principles of lawful processing, purpose limitation and accountability, aligning Malawi with international best practices on data governance. It also provides for individual rights, such as the right to access and rectify personal data, and imposes obligations on both public and private entities handling personal information.

However, the practical implementation of these legal provisions remains a challenge. Enforcement mechanisms are weak, and the newly formed Data Protection Authority faces capacity constraints that limit its ability to monitor compliance effectively. Moreover, broad legal exemptions allow state agencies to bypass specific data protection requirements under the guise of national security, enabling continued surveillance practices. This is particularly concerning, given the government’s investment in interception technologies16 and its historical reliance on lawful interception systems, such as CIRMS, which raised significant privacy concerns when it was introduced in 2011.17

Apart from the Data Protection Act, Malawi’s legal and policy framework is influenced by older statutes, such as the Electronic Transactions and Cyber Security Act (2016), which governs online communication and criminalises cyber offences. Although this law offers a basis for digital transactions, it also gives state authorities broad powers to intercept and monitor communications for security reasons. Likewise, the Communications Act (2016), which introduced mandatory SIM card registration, was implemented in 2018. The introduction of the digital ID programme in 2017 has further centralised personal data, raising additional surveillance risks.18

At the policy level, Malawi has aligned some of its strategies with regional and continental legal and policy frameworks, including the African Union Convention on Cyber Security and Personal Data Protection (commonly known as the Malabo Convention), although domestic implementation remains inconsistent. Despite constitutional guarantees of privacy and freedom of expression, these rights are often undermined by weak oversight mechanisms, limited transparency in surveillance practices and inadequate judicial remedies for privacy breaches. This legal and policy environment forms a complex landscape where formal protections coexist with systemic vulnerabilities, underscoring the need for more robust enforcement, enhanced institutional capacity and increased civil society involvement to ensure that statutory guarantees become genuine protections for citizens’ digital rights.

6 Communication surveillance in Malawi

As in many post-colonial African states, Malawi’s surveillance practices are deeply rooted in its colonial past (1891 to 1964). The first post-colonial President, Hastings Kamuzu Banda (1964-1994), retained many colonial laws to bolster his political control. Among the most notorious were vagrancy provisions in the Penal Code, which criminalised loitering and permitted arbitrary arrests. Although Malawi transitioned to democracy in 1994 and adopted a Constitution that guarantees fundamental rights, including freedom of movement under section 39, these colonial era laws remained in force until the High Court declared them unconstitutional in 2017. 

This background highlights a recurring pattern in Malawi’s contemporary governance structure, particularly the formal adoption of rights-based legal frameworks without a systematic repeal of repressive laws. This issue is worsened by the non-self-executing nature of the Constitution. While section 5 of the Constitution invalidates conflicting laws, in practice, such provisions often necessitate costly legal action, which permits the continued enforcement of unconstitutional statutes.

Under Banda’s authoritarian regime, Malawi was a one-party state under the Malawi Congress Party (MCP). Political opposition was outlawed, media freedom was suppressed, and the President personally controlled state information systems. The state broadcaster, the Malawi Broadcasting Corporation, was the sole broadcaster on shortwave radio. Television was prohibited, and the state or MCP-affiliated entities monopolised the press. Human Rights Watch famously described Malawi during this period as a ‘police state’, where censorship was institutionalised through the Censorship Board, created under the Censorship Act of 1968.19

While the discourse on Banda’s dictatorship often focuses on overt repression and censorship, less attention is given to the systematic surveillance networks underpinning his regime. These included the MCP youth wing (League of Malawi Youth) and the Special Branch of the police, which turned ordinary citizens into informants tasked with monitoring dissent in private spaces.20 Cultural dynamics, such as the nkhoswe/mbumba system, where Banda positioned himself as women’s ‘guardian’, further entrenched this surveillance culture, normalising a panopticon-like society in which suspicion permeated social relations.21 22

Traces of these systems remain embedded in Malawi’s socio-political fabric. Permanent police roadblocks on national roads, despite court rulings that have outlawed these, illustrate the enduring public acceptance of surveillance-oriented security practices. This historical legacy shapes contemporary digital governance. For instance, Hunter and Mare have noted a lack of clear procedural safeguards for the lawful interception of communications in the country, exposing citizens to privacy violations and surveillance of their communications.23

Evidence of such abuse surfaced in 2022 with the detention of investigative journalist Gregory Gondwe, whose arrest was preceded by apparent surveillance of his private communications.24 Similarly, the Electronic Transactions and Cyber Security Act (2016), while designed to regulate digital transactions and establish the Malawi Computer Emergency Response Team, lacks precise definitions and apparent limitations on interception. Section 84(2) further grants the minister discretion to permit interception under unspecified conditions, a loophole susceptible to political exploitation. Provisions such as section 86, which criminalises ‘offensive communications’, have already been used to target critical voices online, exemplified by the 2022 arrest of a nurse for a WhatsApp post criticising the President.25

Parallel developments, such as the National ID programme (2017) and mandatory SIM registration (2018), have significantly expanded state access to personal data. While justified as tools for national planning, financial inclusion and crime prevention, these initiatives aggregate sensitive biometric and demographic information in centralised databases without robust data protection safeguards. As Wanyama notes, mandatory SIM registration has proven ineffective in reducing mobile-related crime elsewhere, such as in Mexico, where the policy was repealed, raising questions about its necessity in Malawi.26 Together, these measures reflect a continuity of surveillance rationales from the Banda era to the digital age: an enduring prioritisation of state control over individual rights.

These frameworks are state-centric, concentrating on national security and public safety while ignoring human rights approaches. While surveillance methods, whether legal or illegal, are often justified by claims of security and governance, they typically exacerbate power imbalances between the state and its citizens, eroding fundamental rights. Civil society theory emphasises the significance of non-state actors as checks on state authority, promoting accountability and safeguarding rights. However, in Malawi, the lack of strong mobilisation around digital rights highlights the fragility of these actors in a setting where political pressures, donor dependency, and limited technical skills hinder their ability to oppose widespread surveillance practices. This gap between theoretical ideals and real-world conditions highlights the need for a more proactive, digitally aware and resilient civil society that can effectively address the challenges of data governance.

7 Civil society engagement and digital rights advocacy

There is no single agreed-upon definition of civil society, and scholars continue to debate its conceptual boundaries. Räthzel and others observe a lack of consensus on what constitutes civil society, though they note that it typically includes ‘non-profit organisations, social movements, non-governmental organisations, and/or smaller associations’ that operate independently of the state.27 Similarly, Ramos conceptualises civil society as existing in contrast to political society, which represents the hegemonic leadership of the state.28 Heinrich further expands this view, defining civil society as an ‘arena in society, distinct from the state, market, and usually the family, where collective action in associations and through other forms of engagement takes place’.29

Historically, Chandhoke traces the evolution of CSOs to the resistance movements in Eastern and Central European Stalinist states and Latin American military regimes, which suppressed fundamental human rights.30 From these contexts emerged two key understandings of civil society: first, as a sustained demand for political rights, particularly freedoms of expression, association and assembly; and second, as an institutionalised mechanism for monitoring and holding state power accountable in democratic contexts. These understandings resonate with the Malawian experience. As Lwanda and Chanika note, CSOs played a pivotal role in the country’s political opposition during its transition from dictatorship to multiparty democracy in the 1990s.31 Since then, CSOs have remained central actors in monitoring state power and promoting accountability.

7.1 Secondary data

On the one hand, the secondary data shows that although civil society organisations have a long history globally, their prominence in Africa is closely tied to the wave of democratisation that began in the late 1980s and early 1990s. In Malawi, the Public Affairs Committee (PAC), a multi-faith coalition, played a critical role in ushering in multiparty politics. Since then, CSOs have influenced several defining political moments. For example, they successfully resisted President Bakili Muluzi’s attempt to extend his presidential term beyond constitutional limits. They mobilised against Bingu wa Mutharika’s increasingly autocratic governance, culminating in the nationwide protests of July 2011. More recently, CSOs under the Human Rights Defenders Coalition (HRDC) spearheaded mass demonstrations against the 2019 general election results, which the Constitutional Court subsequently annulled due to widespread irregularities.32

However, despite these historical successes, CSOs in Malawi have been slow to respond to emerging challenges in the digital sphere. Oduro-Marfo warns that Africa’s increasing digitalisation heightens the risk of privacy violations, mass surveillance and profiling, necessitating sustained advocacy to demand accountability and transparency.33 Yet, Lwanda and Chanika argue that Malawian CSOs have ‘largely failed to call state power to account’, citing their over-reliance on government and donor funding as a key limitation.34 They also highlight knowledge gaps, noting that many CSOs lack technical expertise and fail to utilise existing data effectively.

James and Malunga further identify systemic organisational weaknesses, specifically in identity, leadership, strategy and funding, that hinder the ability of CSOs to fulfil their mandates.35 Without addressing these structural challenges, CSOs risk marginalisation in critical governance debates, including those on digital rights and surveillance. Gabay similarly critiques Malawian civil society as ‘docile’ and resistant to a neoliberal vision of society, characterised by a reduced role for the state and increased citizen agency.36 These assessments underscore the urgent need for revitalised civil society engagement, particularly as digital governance becomes a central arena for contesting human rights in the twenty-first century.

Thus, civil society in Malawi has historically demonstrated significant influence in shaping democratic trajectories, from resisting authoritarian consolidation to championing electoral integrity. However, its limited engagement with the emerging challenges of digital governance and surveillance raises critical questions about its evolving role as a counterweight to state power. Civil society theory presupposes an autonomous and vibrant sphere capable of constraining state overreach and safeguarding individual rights. Yet, Malawi’s experience illustrates how structural dependencies, organisational weaknesses and capacity deficits constrain this ideal. As the digital domain becomes a new frontier for rights advocacy, the gap between normative expectations and practical realities underscores the need to rethink civil society’s strategies, resources and theoretical positioning in an era of pervasive data centralisation and surveillance.

7.2 Key informant interviews

On the other hand, a recurring theme among the key informant interview (KII) respondents is the perception that digital rights require specialised knowledge, which many CSOs in Malawi lack. As Teresa Ndanga, a commissioner with the Malawi Human Rights Commission, explains, ‘digital rights advocacy may sometimes require some specialist knowledge. Most of us have had to educate ourselves to advocate from an informed perspective. Unfortunately, not many would want to invest time and resources.’37 

Similarly, Michael Kaiyatsa, executive director at the Centre for Human Rights and Rehabilitation, notes that many CSOs ‘view digital rights as a highly technical area, often associating it solely with IT, rather than linking it to core human rights principles such as freedom of expression, privacy and access to information’.38 This knowledge gap is closely tied to capacity limitations. As Bram Fudzulani, a chairperson of Malawi Internet Governance Forum, argues, ‘it’s more to do with the capacity building of the CSOs themselves in understanding digital rights and how they impact the work that they themselves do’.39

Several respondents also highlighted that digital rights are often perceived as non-priority or ‘elite’ issues. Ndanga and Vincent Kumwenda, a technology and innovation expert, observes that digital rights, in some cases, are considered rights for the elite. This, in most cases, may translate to rights for the minority. Mwandida Theu, a commissioner with the Malawi Peace and Unity Commission and a human rights defender, reinforces this point, noting that ‘many civil society organisations are more grounded in traditional human rights and governance spaces such as access to justice, gender equality, or service delivery… digital rights are often seen as highly technical or secondary’.40 

She further emphasises the framing issue, stating that ‘many CSOs feel pressure to respond to immediate, tangible community needs … leaving digital rights framed as a “luxury issue” rather than a pressing human rights concern’.41

Funding constraints and donor priorities also significantly influence CSO engagement in digital rights. Ndanga reflects that ‘finances are also always a factor. Now, digital rights are beginning to attract funders, but this wasn’t the case from where we are coming from.’42 In line with this, Theu notes that ‘donor support for CSOs in Malawi has historically focused on sectors such as health, education, democracy, and livelihoods. Digital rights rarely appear as a standalone funding priority.’43 Kaiyatsa adds that ‘there are relatively few funding opportunities specifically targeting digital rights work in many parts of Africa, including Malawi’,44 while Dennis Mwafulirwa, who coordinates Digital Rights Coalition in Malawi, bluntly concludes that ‘most CSOs follow where there’s money. At the moment, support for digital rights initiatives appears to be limited.’45

Mwafulirwa notices that CSOs tend to focus on trending issues rather than initiating work in under-discussed areas. He observes that people pursue what already is trending. Few are willing to start initiatives that are not being done by others, and highlight the effect of low awareness: ‘Limited knowledge or awareness on digital rights among CSOs as well as limited capacity and perceived capacity gaps to run/implement digital rights initiatives.’46 Political sensitivity further discourages engagement. As Theu explains, ‘issues such as freedom of expression online, surveillance, and access to information are sometimes perceived as politically risky. Smaller CSOs, in particular, may shy away from openly challenging restrictive digital policies for fear of backlash.’47

Despite these barriers, some respondents express cautious optimism. Ndanga and Theu observe that there is an increasing likelihood that more CSOs will join the digital rights advocacy because funding opportunities are now opening up. The interest has, in part, been sparked by the rise of misinformation, cyber harassment and concerns about data protection, which are prompting more CSOs to recognise that digital rights are human rights.

8 Discussion and analysis

Malawi has made notable progress in establishing a legal framework for digital rights through the enactment of the Data Protection Act (2024) and the creation of the Data Protection Authority (2025). These initiatives demonstrate the government’s intention to regulate the collection, storage and use of personal data, as well as to protect citizens’ privacy. The Data Protection Act introduces principles of lawful processing, purpose limitation and accountability, while providing individuals with rights such as access to and correction of their personal information. 

Despite these statutory advances, practical implementation remains inconsistent. Enforcement mechanisms are weak, institutional capacity is limited, and broad legal exemptions allow state agencies to bypass statutory safeguards under the guise of national security. Historical surveillance patterns, exemplified by CIRMS and subsequent initiatives such as mandatory SIM registration and the digital identification programme, highlight the ongoing risk of surveillance and privacy breaches. These measures, while often justified as tools for security, financial inclusion or national planning, centralise sensitive data and sustain a state-centric approach to governance that prioritises control over human rights.48 49

In an ideal scenario, CSOs are positioned as essential intermediaries between formal legal protections and their realisation, offering oversight, public education and advocacy to guarantee that rights are recognised in statutes and upheld in practice. However, drawing on civil society theory, which highlights the role of voluntary associations in shaping democratic governance and promoting socio-political cohesion, this study finds that CSO engagement in digital rights in Malawi remains limited in scope and effectiveness. An analysis of key informant interviews uncovers several structural and contextual barriers. 

A recurring theme is the lack of technical expertise. One of the key informants, Teresa Ndanga,50 notes that digital rights advocacy may sometimes require specialised knowledge. Yet, most CSOs have had little understanding of digital rights, and those who do have an understanding have had to educate themselves to advocate from an informed perspective. Unfortunately, not many would want to invest time and resources. Another key informant, Michael Kaiyatsa, similarly notes that many CSOs view digital rights as a highly technical area, often associating it solely with ICTs, rather than linking it to core human rights principles such as freedom of expression, privacy, and access to information.51 Bram Fudzulani further underscores that these knowledge gaps are compounded by broader capacity limitations, stating that ‘it’s more to do with the capacity building of the CSOs themselves in understanding digital rights and how they impact the work that they themselves do’.52

Beyond technical limitations, respondents highlighted the perception of digital rights as non-priority or ‘elite’ issues. Ndanga and Vincent Kumwenda note that these rights are frequently viewed as serving only a minority. At the same time, Mwandida Theu observes that many CSOs are more grounded in traditional human rights and governance spaces, such as access to justice, gender equality or service delivery. For these, the digital rights space is often perceived as highly technical or as an afterthought.53 The framing of digital rights as a ‘luxury issue’ is compounded by funding constraints, as donor priorities historically emphasise health, education and livelihoods, leaving digital rights under-resourced.

According to Dennis Mwafulirwa, most CSOs follow the money, while support for digital rights initiatives appears to be limited.54 This shows that the CSOs are trend-driven. This approach discourages proactive engagement with nuanced and emerging issues, as organisations often pursue matters that are already visible or popular rather than pioneering under-discussed areas. Political sensitivity further limits advocacy: As Theu explains, ‘issues such as freedom of expression online, surveillance, and access to information are sometimes perceived as politically risky. Smaller CSOs, in particular, may shy away from openly challenging restrictive digital policies for fear of backlash.’55

Despite these barriers, signs of change are emerging. Growing concerns over misinformation, cyber harassment and data protection are leading CSOs to recognise digital rights as a topic worth discussing. As Ndanga notes, increasing funding opportunities and heightened public awareness are encouraging more organisations to engage in advocacy. This suggests a potential shift toward integrating digital rights into broader human rights agendas, highlighting the importance of capacity building, public education and strategic advocacy. Civil society theory posits that autonomous, active non-state actors are crucial for preventing state overreach and safeguarding rights.

However, in Malawi, structural dependencies, limited technical skills and donor influence hinder the realisation of this ideal. This gap highlights an urgent need to strengthen civil society’s capacity to translate legal frameworks into robust protections effectively. As a result, the Malawian experience demonstrates that legal reforms, while important, are insufficient to ensure digital rights. Civil society involvement is essential for implementing these protections, yet current limitations (technical, financial, political and perceptual) prevent effective advocacy. Nonetheless, the increasing visibility of digital threats offers an opportunity for CSOs to adjust strategies, attract resources and integrate digital rights into the broader human rights dialogue. Improving CSO capacity, encouraging collaboration with international and regional actors, and utilising public awareness campaigns can all help increase transparency, accountability and the safeguarding of citizens’ digital rights, bridging the gap between laws and everyday experiences in Malawi.

9 Conclusion

Although Malawi’s legal frameworks lay a foundation for protecting digital rights, their effectiveness relies on proactive, capable and well-supported CSOs. By addressing capacity, funding and advocacy gaps, and by encouraging collaboration between government and non-governmental actors, Malawi can progress towards a governance system where citizens’ privacy, freedom of expression and overall human rights are protected in the digital age. CSOs play a vital role in bridging the gap between legal frameworks and the real protection of digital rights. This study finds that insufficient technical expertise, capacity deficits, dependency on funding and political sensitivities limit CSO involvement. Digital rights are often seen as secondary or elite issues, which further hampers advocacy efforts. 

Yet, emerging challenges, such as misinformation, cyber harassment and data protection concerns, are increasingly recognised by civil society actors as urgent human rights issues. These developments offer an opportunity to mainstream digital rights advocacy and integrate it into broader democratic governance and human rights agendas. To strengthen the protection of digital rights in Malawi, several prerequisites are necessary. First, CSOs should invest in capacity building and technical expertise, including training on data protection, surveillance and privacy law, to enable informed advocacy.

Second, donor agencies and development partners should provide targeted funding for digital rights initiatives, encouraging innovative approaches that address both emerging threats and systemic gaps. Third, CSOs should develop collaborative networks, both nationally and regionally, to enhance the impact of their advocacy, share best practices and amplify public education efforts. Fourth, government institutions, including the Data Protection Authority, should strengthen enforcement mechanisms, improve transparency and establish clear oversight structures to prevent the abuse of surveillance powers. Ultimately, public awareness campaigns are crucial in empowering citizens to understand, demand and exercise their digital rights.