Malta

Regulator And AuthorityGreen

The IDPC is appointed under Article 11 of the Act as the national independent supervisory authority responsible for monitoring the application of the Act, subsidiary legislation, the Freedom of Information Act, and the GDPR.

Claims (1):

• The IDPC is the national independent supervisory authority responsible for upholding the fundamental right of individuals to have their personal data protected and to monitor the application of data protection law in Malta.

Act And InstrumentsGreen

The Act (Cap. 586) came into force on 28 May 2018 replacing the former Data Protection Act (Cap. 440), and is accompanied by subsidiary legislation including the Processing of Personal Data (Electronic Communications Sector) Regulations and the Processing of Personal Data (Protection of Minors) Regulations.

Claims (1):

• The Data Protection Act (Chapter 586 of the Laws of Malta), implementing the GDPR, came into effect on 28 May 2018, replacing the former Data Protection Act (Chapter 440).

Material ScopeGreen

Material scope tracks the GDPR directly (processing of personal data by controllers/processors), with no national variation to the definitions of controller, processor, personal data, sensitive data or health data.

Claims (1):

• Malta applies no national variation to the GDPR definitions of data controller, data processor, personal data, sensitive data, or health data.

Territorial ScopeGreen

GDPR Article 3 extraterritorial scope applies directly in Malta; the IDPC has exercised jurisdiction analysis over controllers claiming establishment in Malta in prior enforcement decisions.

Claims (1):

• The IDPC has, in prior enforcement matters, investigated and made determinations on whether a controller's main establishment is genuinely located in Malta for GDPR one-stop-shop jurisdictional purposes.

Regulator Registration And FilingAmber

No general controller-registration regime distinct from the GDPR; obligations are limited to internal accountability documentation (ROPA, DPO notification) rather than a public filing scheme.

Absence provenance: unavailable. Searched: Malta IDPC registration filing controllers, Malta Data Protection Act Cap 586 registration.

Lawful BasesGreen

The six GDPR Article 6 lawful bases apply with direct effect; Malta has not enacted a materially different lawful-basis framework.

Claims (1):

• The GDPR Article 6 lawful bases for processing apply with direct effect in Malta without a materially different national framework.

Consent ThresholdsGreen

GDPR Article 7 consent standards (freely given, specific, informed, unambiguous, revocable) apply directly.

Claims (1):

• GDPR Article 7 consent standards requiring free, specific, informed and unambiguous consent, revocable without detriment, apply directly in Malta.

Special CategoriesGreen

Subsidiary legislation permits processing of health data for insurance purposes as a national derogation from Article 9, and the IDPC has issued sector guidelines on credit referencing and disclosure of health data in occupational-medicine contexts.

Claims (2):

• Malta's subsidiary legislation takes advantage of national derogations allowing processing of health information for insurance purposes.
• The IDPC has published guidelines for the promotion of good practice in the processing of personal data by credit referencing institutions and on disclosure of health data in occupational medicine contexts.

Pseudonymisation And AnonymisationAmber

No Malta-specific statutory definition or safe-harbour for pseudonymisation/anonymisation beyond the GDPR text was identified in available sources.

Absence provenance: unavailable. Searched: Malta Data Protection Act pseudonymisation anonymisation derogation.

Access RightGreen

The GDPR Article 15 access right applies directly; the IDPC launched a public consultation on the data access right in mid-2024.

Claims (1):

• The IDPC launched a consultation on the data access right for individuals in Malta in mid-2024.

Rectification And ErasureGreen

GDPR Articles 16-17 rectification/erasure rights apply directly with no identified national variation.

Claims (1):

• GDPR Articles 16 and 17 rectification and erasure rights apply directly in Malta with no identified national variation.

Restriction And ObjectionGreen

The IDPC has issued a binding decision addressing a controller's handling of a data subject's right to object to direct-marketing emails.

Claims (1):

• The IDPC issued a decision assessing a controller's compliance with a data subject's right to object to direct marketing emails, examining the controller's establishment and cooperation with the investigation.

Data PortabilityAmber

GDPR Article 20 portability right applies directly; no Malta-specific guidance located beyond the general GDPR text.

Absence provenance: unavailable. Searched: Malta IDPC data portability guidance.

Deadlines And Response WindowsGreen

The standard GDPR one-month response window (extendable by two further months for complex requests) applies directly in Malta.

Claims (1):

• The standard GDPR one-month controller response window, extendable by two additional months for complex requests, applies directly in Malta.

Accountability And DpiaGreen

GDPR Articles 5, 24, 25 and 35 accountability/DPIA obligations apply directly; no Malta-specific DPIA threshold list beyond EDPB/IDPC general guidance was located.

Claims (1):

• GDPR Articles 5, 24, 25 and 35 accountability, privacy-by-design and DPIA obligations apply directly to controllers and processors in Malta.

Dpo RequirementsGreen

GDPR Articles 37-39 DPO appointment/independence rules apply directly; the IDPC published 20 FAQs on DPO obligations in January 2025.

Claims (1):

• The IDPC released a set of 20 FAQs on data protection officers on 29 January 2025, addressing DPO role and appointment questions.

Ropa RequirementsGreen

GDPR Article 30 records-of-processing obligations apply directly with no identified national variation.

Claims (1):

• GDPR Article 30 records-of-processing-activities obligations apply directly in Malta with no identified national variation.

Joint Controller ArrangementsGreen

GDPR Articles 26 and 28 joint-controller/processor obligations apply directly; no Malta-specific overlay identified.

Absence provenance: unavailable. Searched: Malta joint controller processor agreement guidance IDPC.

Security MeasuresGreen

GDPR Article 32 security-of-processing obligations apply directly; the IDPC has fined a public authority for failing to implement adequate technical and organisational measures.

Claims (1):

• The IDPC found the Lands Authority to have infringed Article 32 GDPR for lacking necessary technical and organisational measures on its online application portal, and served an administrative fine of €5,000 under Article 21 of the Data Protection Act.

Breach NotificationGreen

GDPR Articles 33-34 breach-notification duties apply directly, backed by Article 21 Act administrative fines; the IDPC has issued public breach decisions including a €65,000 fine against a controller (C-Planet) for a data breach.

Claims (2):

• The fine level for GDPR Article 32 breaches under Article 21 of the Data Protection Act is set with reference to the aggravating/mitigating circumstances listed in GDPR Article 83(2).
• The IDPC fined the controller C-Planet €65,000 in relation to a data breach.

Retention And DisposalGreen

General GDPR storage-limitation principles apply, supplemented by the Retention of Data (Malta Gaming Authority) Regulations (S.L. 583.12) which govern the MGA's retention of personal data collected in its regulatory functions.

Claims (1):

• The Retention of Data (Malta Gaming Authority) Regulations (Subsidiary Legislation 583.12) regulate the retention by the Malta Gaming Authority of personal data collected or otherwise processed in the pursuit of its regulatory functions.

Transfer MechanismsGreen

GDPR Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Article 49 derogations) apply directly; the Act tasks the IDPC with facilitating the free flow of personal data between Malta and other Member States.

Claims (1):

• The IDPC is responsible for facilitating the free flow of personal data between Malta and other EU Member States under Part V of the Data Protection Act.

Adequacy ReceivedGreen

Malta does not issue independent adequacy decisions as an EU Member State; adequacy is determined at EU level and applies uniformly across Malta as elsewhere in the Union.

Absence provenance: unavailable. Searched: Malta national adequacy decision received.

Adequacy GrantedGreen

Malta does not grant its own adequacy decisions; this competence sits exclusively with the European Commission at EU level under GDPR Article 45.

Absence provenance: unavailable. Searched: Malta national adequacy decision granted third country.

Sccs And BcrsGreen

EU Standard Contractual Clauses (2021 Commission Decision) and BCRs approved under the GDPR Article 47 consistency mechanism apply directly in Malta.

Claims (1):

• EU Standard Contractual Clauses and BCRs approved under GDPR Article 47 apply directly to transfers from Malta as an EU Member State.

Transfer Impact AssessmentAmber

Post-Schrems II transfer impact assessment obligations apply to Malta-based exporters in the same manner as across the EU; no Malta-specific TIA methodology beyond EDPB guidance was identified.

Absence provenance: unavailable. Searched: Malta IDPC transfer impact assessment guidance.

Data LocalisationAmber

No general data-localisation mandate was identified for Malta; sector-specific retention obligations exist for Malta Gaming Authority regulatory data but do not amount to a data-localisation requirement per se.

Absence provenance: unavailable. Searched: Malta data localisation requirement law.

Financial Sector OverlayAmber

No independently verified Malta-specific financial-sector (MFSA) data-protection overlay beyond general GDPR application and IDPC credit-referencing guidelines was located in this research pass.

Absence provenance: unavailable. Searched: Malta MFSA data protection overlay GDPR.

Claims (1):

• The IDPC's credit-referencing guidelines are the primary identified sector-specific data-protection instrument touching the financial sector; a distinct MFSA-issued data-protection overlay was not independently confirmed.

Health Sector OverlayGreen

Subsidiary legislation permits processing of health data for insurance purposes, and the IDPC has issued guidelines on disclosure of health data in occupational-medicine and working-capacity assessment contexts.

Claims (1):

• Malta's subsidiary legislation allows processing of health information for insurance purposes, and IDPC guidelines address disclosure of health data in occupational medicine and assessment of working capacity.

Telecoms And EprivacyGreen

The ePrivacy Directive (2002/58/EC, as amended) is transposed via the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01), with the IDPC as competent authority; the IDPC and UK ICO cooperate on cross-border enforcement including unsolicited electronic marketing.

Claims (1):

• The IDPC is the competent authority responsible for monitoring the application of the ePrivacy Directive as implemented by the Processing of Personal Data (Electronic Communications Sector) Regulations, Subsidiary Legislation 586.01.

Employment DataGreen

The IDPC has published guidelines on the data-protection aspects of collecting employees' COVID-19 vaccination status.

Claims (1):

• The IDPC has published guidelines on the data protection aspects related to the collection of employees' COVID-19 vaccination status.

Credit And ScoringGreen

The IDPC has published guidelines for the promotion of good practice in the processing of personal data by credit-referencing institutions.

Claims (1):

• The IDPC has published guidelines for the promotion of good practice in the processing of personal data by credit referencing institutions.

EducationAmber

Subsidiary legislation exists addressing the education sector, but the specific instrument and its provisions were not independently retrieved in full in this pass.

Absence provenance: unavailable. Searched: Malta education sector data protection regulation subsidiary legislation.

InsuranceGreen

Insurance-sector processing of health data is governed by a national derogation permitting such processing for insurance purposes, per subsidiary legislation issued under the Act.

Claims (1):

• Malta's subsidiary legislation includes a national derogation permitting processing of health data for insurance purposes.

Cookies And TrackersGreen

The IDPC published cookie-consent guidance and the ePrivacy transposition requires consent for non-essential cookies/trackers.

Claims (1):

• The IDPC published cookie-consent guidance addressing the use of cookies and trackers under the ePrivacy transposition.

Dark PatternsAmber

No Malta-specific dark-pattern prohibition distinct from general GDPR consent-validity requirements was identified.

Absence provenance: unavailable. Searched: Malta dark patterns IDPC guidance.

Opt Out SignalsAmber

No Malta-specific recognition of Global Privacy Control or DAA-style opt-out signals was identified.

Absence provenance: unavailable. Searched: Malta Global Privacy Control opt-out signal recognition.

Clean Rooms And DcrAmber

No Malta-specific clean-room or data-collaboration-room framework was identified.

Absence provenance: unavailable. Searched: Malta data clean room regulation.

Cross Context AdvertisingAmber

Malta has no CPRA-style statutory 'sale'/'share' construct; cross-context advertising is governed by ordinary GDPR consent/legitimate-interest analysis.

Absence provenance: unavailable. Searched: Malta cross context advertising sale share equivalent.

Direct MarketingGreen

Unsolicited electronic marketing is governed by the ePrivacy transposition (S.L. 586.01), and the IDPC cooperates with the UK ICO on cross-border enforcement of unsolicited marketing rules analogous to PECR.

Claims (1):

• The IDPC and the UK Information Commissioner's Office signed a Memorandum of Understanding establishing cross-border enforcement cooperation, referencing enforcement powers over unsolicited marketing analogous to PECR.

Profiling RestrictionsGreen

GDPR Article 22 restrictions on solely automated decision-making producing legal/significant effects, including profiling, apply directly.

Claims (1):

• GDPR Article 22 restrictions on decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect the data subject, apply directly in Malta.

Automated Decision Making TransparencyGreen

GDPR Articles 13-15 transparency and explanation obligations for automated decision-making apply directly in Malta.

Claims (1):

• GDPR Articles 13-15 transparency obligations, including information on the existence of automated decision-making and its logic, apply directly in Malta.

Ai Risk AssessmentsGreen

The IDPC was designated as both a Fundamental Rights Authority and a Market Surveillance Authority under the EU AI Act, and has issued guidance highlighting revised EU AI Act implementation timelines.

Claims (2):

• The IDPC was designated as a Fundamental Rights Authority (FRA) and a Market Surveillance Authority (MSA) under the EU AI Act.
• All EU Member States, including Malta, were required to designate national competent authorities under the EU AI Act by 2 August 2025.

Biometric RegimeAmber

Biometric data is treated as a GDPR Article 9 special category; no distinct Malta-specific biometric (e.g., facial-recognition-specific) statute was identified.

Absence provenance: unavailable. Searched: Malta biometric data facial recognition law.

Genetic DataAmber

Genetic data is treated as a GDPR Article 9 special category with no identified Malta-specific derogation.

Absence provenance: unavailable. Searched: Malta genetic data derogation law.

State Surveillance CarveoutsAmber

National-security processing carve-outs follow the general GDPR Article 2(2)/23 and Law Enforcement Directive framework, monitored in part by the IDPC per its MoU with the UK ICO referencing the Law Enforcement Directive.

Absence provenance: unavailable. Searched: Malta state surveillance national security data protection carveout detail.

Claims (1):

• The IDPC is the competent authority in Malta for monitoring the application of the Law Enforcement Directive (2016/680), which governs national-security/law-enforcement processing carve-outs from the general GDPR regime.

Age VerificationGreen

Malta sets the digital age of consent at 13, a national derogation from the GDPR Article 8 default of 16.

Claims (1):

• Article 8 of the GDPR as well as Article 4 of the Processing of Children's Data Regulations states that processing of the personal data of a child in relation to information society services is lawful where the child is 13 years of age.

Parental ConsentGreen

Below age 13, parental/guardian consent is required for information-society-service processing per GDPR Article 8 as transposed by the Protection of Minors Regulations.

Claims (1):

• For children below the applicable age threshold, GDPR Article 8 requires that the holder of parental responsibility consent to information-society-service processing, as transposed into Malta's Protection of Minors Regulations.

Minor Profiling BansAmber

No explicit minor-specific profiling ban beyond the general GDPR Article 22 protections was identified.

Absence provenance: unavailable. Searched: Malta minor profiling ban regulation.

Education SettingsGreen

The Protection of Minors Regulations provide that where a teacher, school administrator, or person acting in loco parentis processes a minor's data in the minor's best interest, parental consent is not required and, in such cases, the parent/guardian has no right of access to that data.

Claims (1):

• Under the Protection of Minors Regulations, where information is derived by a teacher, school administration member, or person acting in a professional capacity in place of a minor's parents, such information may be processed without requiring consent from the minor's parents or guardian where consent would be prejudicial to the minor's best interest, and the parent/guardian shall not have access to such data.

Dependent AdultsAmber

No Malta-specific dependent-adults (elderly, mentally incapacitated) data-protection regime distinct from the general GDPR framework was identified.

Absence provenance: unavailable. Searched: Malta dependent adults data protection vulnerable adults regulation.

Regulator Powers And PenaltiesGreen

The IDPC holds GDPR Article 58 investigative and corrective powers and may impose administrative fines under Article 21 of the Act, up to the GDPR Article 83 statutory maxima.

Claims (1):

• The IDPC may impose administrative fines under Article 21 of the Data Protection Act, with fine levels set by reference to the aggravating and mitigating circumstances under GDPR Article 83(2), up to the GDPR statutory maxima.

Enforcement Activity IndexAmber

Documented recent enforcement includes a €5,000 fine against the Lands Authority (2019) and a €65,000 fine against C-Planet for a data breach.

Absence provenance: unavailable. Searched: Malta IDPC 2026 guidance decision fine news.

Claims (1):

• The IDPC fined the Lands Authority €5,000 in 2019 for an Article 32 GDPR security-of-processing breach, and fined the controller C-Planet €65,000 in relation to a data breach.

Regulator Funding And CapacityRed

No public data on IDPC headcount, budget, or capacity was located in this research pass.

Absence provenance: unavailable. Searched: IDPC Malta budget headcount funding capacity.

Collective Redress And Class ActionsAmber

GDPR Article 80 representative-action rights apply directly; Malta-specific implementation detail of the EU Representative Actions Directive as it applies to data protection claims was not independently confirmed.

Absence provenance: unavailable. Searched: Malta representative actions directive data protection collective redress.

Claims (1):

• GDPR Article 80 representative-action rights, permitting not-for-profit bodies to lodge complaints and seek judicial remedies on behalf of data subjects, apply directly in Malta.

Private Right Of ActionGreen

GDPR Article 79 provides a direct judicial-remedy right, and Article 26 of the Act provides a right of appeal against IDPC decisions on data breaches.

Claims (1):

• Pursuant to Article 26 of the Data Protection Act, any person aggrieved by a decision of the IDPC regarding data breaches has the right to appeal.

Recent Developments 180DRed

No confirmed IDPC or Maltese-legislative developments within the trailing 180 days (February-August 2026) were located; the most recent identified developments are the January 2025 DPO FAQs, the 2025 AI Act FRA/MSA designation, and a mid-2024 access-right consultation, all outside the 180-day window.

Absence provenance: unavailable. Searched: Malta IDPC 2026 guidance decision fine news, Malta data protection law amendment 2026.