--- title: "Malta Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/malta-data-protection-privacy-regulation/ source_html: /jurisdictions/malta/index.html description: "Malta data protection and privacy regulation: 10 categories, 57 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 9140e639cdb4b4329771e67466a209aa9039796780649ffd7be838feb1229639 generator: "fe-fleet/md-twin@1.0" --- # Malta Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/malta/), [World Payments](https://payments.gi/jurisdictions/malta/), [Advennt](https://advennt.io/jurisdictions/malta/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 57 claims · 35 sources in the cumulative register Download report (PDF) Expand all Malta's Information and Data Protection Commissioner (IDPC) is Malta's national independent supervisory authority for data protection, designated under Article 11 of the Data Protection Act, Chapter 586. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Controller/Processor Duties, Cross-Border & Adequacy, AdTech & Commercial Privacy (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MALTA)[Build Report](/reports/?j=MALTA)[Compare](/compare/?j=MALTA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Information and Data Protection Commissioner (IDPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2027-08-02 AI regulatory sandbox deadline postponed Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 57 Claims 9 Tier-1 sources Traffic-light mix 6 green 4 amber (sums to 10 rendered categories; click to filter) No red categories; 2 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Malta is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Malta’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 921 Full executive summary 468 ###### Latest update · 18 October 2026 #### Lead Signal The European Data Protection Board adopted a harmonised methodology for the calculation of administrative fines, together with the final version of its guidelines on the interplay between the Digital Services Act and the GDPR, at its plenary on 22 September 2026. Malta's Information and Data Protection Commissioner, as an EDPB member, is bound to apply this methodology going forward. This is a structural development in how the IDPC will calculate any future administrative fine, rather than a change to the underlying substantive grounds for enforcement, and it sits on top of the existing GDPR Article 83 and Data Protection Act Article 21 framework under which the IDPC may already impose fines of up to the higher of twenty million euro or four percent of global turnover for the most serious infringements, with lower caps of twenty-five thousand euro per violation plus twenty-five euro per day for public authorities, rising to fifty thousand euro plus fifty euro per day for Article 83(4) infringements. #### Other Developments A harmonised fining methodology now constrains how the IDPC quantifies penalties. Because the IDPC is an EDPB member, the newly adopted harmonised methodology is understood to bind its approach to calculating fines within the existing statutory ceilings, rather than altering those ceilings themselves. The practical effect for any entity under IDPC enforcement scrutiny is that the path from a finding of infringement to a quantified fine is now expected to follow a common EU-wide calculation approach rather than a purely Maltese methodology. #### Cross-Monitor Connections The harmonised fining methodology and the DSA-GDPR interplay guidelines both touch ground the financial-integrity monitor also tracks in respect of EU supervisory architecture generally, though the specific substance here is the EDPB's own enforcement-methodology work rather than a financial-integrity finding; readers tracking cross-sector EU supervisory convergence should view this alongside financial-integrity's coverage of the AMLA/AMLR rollout as parallel instances of EU-level harmonisation reshaping how national authorities exercise their powers. #### Outlook The item to watch is how the IDPC's first fine calculated under the new harmonised methodology compares with its pre-methodology enforcement pattern, which will be the first practical test of whether the EDPB's harmonisation changes outcomes as well as process. No specific IDPC enforcement action applying the new methodology has yet been identified. 2 earlier updates not shown here. ###### Standing brief · as of 4 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Malta's Information and Data Protection Commissioner (IDPC) is Malta's national independent supervisory authority for data protection, designated under Article 11 of the Data Protection Act, Chapter 586. The IDPC is understood to have been designated as a Fundamental Rights Authority (FRA) and a Market Surveillance Authority (MSA) under the EU AI Act, a development dated to March 2025. The EU AI Act required all EU Member States, including Malta, to designate national competent authorities by 2 August 2025. This designation is understood to extend the IDPC's statutory remit beyond core GDPR enforcement and to position it centrally in Malta's emerging AI-governance architecture. Malta's existing GDPR framework already gives the IDPC oversight of automated decision-making: GDPR Article 22 restricts decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on a data subject, and Articles 13 to 15 require transparency about the existence and logic of such automated decision-making, both applying directly in Malta. #### Other Developments This cycle establishes the first full baseline interpretation for Malta across the ten-module Data Protection Monitor spine. The Data Protection Act, Chapter 586, came into force on 28 May 2018, replacing the former Data Protection Act, Chapter 440. GDPR Article 6 lawful bases apply with direct effect in Malta, without a materially different national framework. The IDPC is understood to have launched a public consultation on the data access right in mid-2024. The IDPC is understood to have released twenty FAQs on data protection officers on 29 January 2025. The IDPC fined the Lands Authority €5,000 under Article 21 of the Data Protection Act for an Article 32 security-of-processing infringement on its online application portal. The IDPC's free-flow facilitation duty is understood to rest on Article 11(2) of the Data Protection Act, Chapter 586, a statutory attribution corrected this cycle following verification against the Act's official text. Malta sets the digital age of consent at 13 under GDPR Article 8 and the Protection of Minors Regulations, a national derogation from the GDPR default of 16. #### Cross-Monitor Connections The IDPC's understood designation as a Fundamental Rights Authority and Market Surveillance Authority under the EU AI Act is an AI-Act competent-authority development for the artificial-intelligence monitor to track directly; this brief retains only the data-protection and profiling angle. Malta's Retention of Data (Malta Gaming Authority) Regulations are understood to be a gambling-sector data-retention overlay directly relevant to Advennt's gambling-regulation remit. The IDPC's credit-referencing guidance may intersect with financial-crime and anti-money-laundering data-sharing obligations relevant to the financial-integrity monitor's remit. #### Outlook A methodological caveat carries into the next cycle: this run's source-count telemetry recorded zero Tier-1, Tier-2 and Tier-3 sources despite several Confirmed-tier claims being anchored to a documented Tier-1 to Tier-3 register, a contradiction escalated for human verification before publication. No confirmed IDPC enforcement or legislative activity within the trailing 180 days is understood to have occurred, and regulator funding and headcount data remain unpublished, limiting visibility into the IDPC's current enforcement capacity relative to its expanding AI Act remit. The FRA/MSA designation remains the single most material near-term item to watch in Malta's regime. Read full brief · 921 words ###### Latest update · 25 October 2026 #### Regulatory Status Malta's data protection enforcement architecture remains anchored in GDPR Article 83 and Data Protection Act Article 21, under which the Information and Data Protection Commissioner may impose fines up to the higher of twenty million euro or four percent of global turnover for the most serious infringements, with reduced caps for public authorities. The development is procedural rather than substantive: the European Data Protection Board adopted, on 22 September 2026, a harmonised methodology for calculating administrative fines and finalised its guidelines on the interplay between the Digital Services Act and the GDPR, both of which bind the IDPC as an EDPB member. #### Outlook Watch for the IDPC's first fine calculated under the new harmonised EDPB methodology as the first practical indicator of its effect on Maltese enforcement outcomes. 2 earlier updates not shown here. ###### Standing brief · as of 4 August 2026 #### Regulatory Status Malta's Information and Data Protection Commissioner (IDPC) is designated as the country's national independent supervisory authority for data protection under Article 11 of the Data Protection Act, Chapter 586. GDPR Article 6 lawful bases apply with direct effect in Malta, without a materially different national framework. The IDPC is understood to have launched a public consultation on the data access right in mid-2024. The IDPC fined the Lands Authority €5,000 under Article 21 of the Data Protection Act for an Article 32 security-of-processing infringement on its online application portal. EU Standard Contractual Clauses and Binding Corporate Rules under GDPR Article 47 apply directly to transfers from Malta as an EU Member State. The IDPC is the competent authority for monitoring the ePrivacy Directive as transposed by S.L. 586.01. The IDPC and the UK Information Commissioner's Office signed a Memorandum of Understanding establishing cross-border enforcement cooperation. The IDPC is understood to have been designated as a Fundamental Rights Authority and a Market Surveillance Authority under the EU AI Act, a development dated to March 2025. Malta sets the digital age of consent at 13 under GDPR Article 8 and the Protection of Minors Regulations, a national derogation from the GDPR default of 16. The IDPC may impose administrative fines under Article 21 of the Data Protection Act, with fine levels set by reference to the aggravating and mitigating circumstances in GDPR Article 83(2). #### Outlook Malta's regime remains a stable, direct-effect GDPR omnibus framework with national divergence concentrated in the digital age of consent, an education-setting carve-out, and an insurance-sector health-data derogation; the IDPC's 2025 EU AI Act designation is the most material recent development and is treated as an elevated watch-item, while no confirmed enforcement activity within the trailing 180 days and unpublished regulator capacity data limit visibility into current enforcement posture. Read full brief · 468 words Key regulatory facts for Malta Regulatory Dimension Malta Standing Position Jurisdiction Malta (MT) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 57 sourced findings) Regulator & Framework Fully GDPR-aligned omnibus regime with an operational, independent supervisory authority and established subsidiary legislation; no material derogation gaps identified. Lawful Processing & Special Data Direct-effect GDPR bases plus targeted, identified national derogations for insurance/health and credit referencing. Data Subject Rights GDPR direct effect plus active IDPC enforcement/consultation record on subject rights. Controller/Processor Duties Comprehensive GDPR-direct-effect duties with demonstrated enforcement precedent and sector-specific retention overlay for gambling regulatory data. Primary Instruments Cited ICO, DataGuidance, EDPB / IDPC, Malta Official Instrument (resguard-solutions.com malta-gdpr-data-protection-guide), RecordingLaw Last Confirmed / Updated 2026-10-25 (35 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Malta: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully GDPR-aligned omnibus regime with an operational, independent supervisory authority and established subsidiary legislation; no material derogation gaps identified. Primary framework GDPR (Regulation (EU) 2016/679) as implemented by the Data Protection Act, Chapter 586 of the Laws of Malta Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Green Fully GDPR-aligned omnibus regime with an operational, independent supervisory authority and established subsidiary legislation; no material derogation gaps identified. #### Sub-modules (5) #### Regulator And AuthorityGreen The IDPC is appointed under Article 11 of the Act as the national independent supervisory authority responsible for monitoring the application of the Act, subsidiary legislation, the Freedom of Information Act, and the GDPR. Claims (3): - The IDPC is the national independent supervisory authority responsible for upholding the fundamental right of individuals to have their personal data protected and to monitor the application of data protection law in Malta. - Information and Data Protection Commissioner (IDPC) — The IDPC is Malta's single national supervisory authority under the Data Protection Act (Cap. 586), entirely distinct from the MFSA. - Information and Data Protection Commissioner (IDPC) — IDPC is Malta's independent national supervisory authority under GDPR, established under Chapter 586, in force since 28 May 2018. #### Act And InstrumentsGreen The Act (Cap. 586) came into force on 28 May 2018 replacing the former Data Protection Act (Cap. 440), and is accompanied by subsidiary legislation including the Processing of Personal Data (Electronic Communications Sector) Regulations and the Processing of Personal Data (Protection of Minors) Regulations. Claims (1): - The Data Protection Act (Chapter 586 of the Laws of Malta), implementing the GDPR, came into effect on 28 May 2018, replacing the former Data Protection Act (Chapter 440). #### Material ScopeGreen Material scope tracks the GDPR directly (processing of personal data by controllers/processors), with no national variation to the definitions of controller, processor, personal data, sensitive data or health data. Claims (1): - Malta applies no national variation to the GDPR definitions of data controller, data processor, personal data, sensitive data, or health data. #### Territorial ScopeGreen GDPR Article 3 extraterritorial scope applies directly in Malta; the IDPC has exercised jurisdiction analysis over controllers claiming establishment in Malta in prior enforcement decisions. Claims (1): - The IDPC has, in prior enforcement matters, investigated and made determinations on whether a controller's main establishment is genuinely located in Malta for GDPR one-stop-shop jurisdictional purposes. #### Regulator Registration And FilingAmber No general controller-registration regime distinct from the GDPR; obligations are limited to internal accountability documentation (ROPA, DPO notification) rather than a public filing scheme. Malta is an EU Member State in which the GDPR applies with direct effect; the Data Protection Act (Chapter 586 of the Laws of Malta) transposes the Member-State-discretion elements of the GDPR and establishes the Office of the Information and Data Protection Commissioner (IDPC) as the national supervisory authority. The regime is supplemented by sector-specific subsidiary legislation (electronic communications, protection of minors, MGA data retention) issued under the Act. Periodic update · new data 2026-09-05 #### Regulator & Framework Malta's Information and Data Protection Commissioner derives its statutory independence from Article 12(1) of the Data Protection Act, Chapter 586, which prohibits the Commissioner from seeking or accepting instructions from any person or entity, including government ministries. This is a settled, standing statutory guarantee rather than a new development this cycle. What is actively evolving is the IDPC's dual mandate: since 2024 the IDPC has additionally served as Malta's Market Surveillance Authority for high-risk AI systems used in law enforcement, migration and border control, and justice and democracy contexts under the EU AI Act. This cycle the IDPC drew attention to revised EU AI Act implementation timelines following Council approval on 27 July 2026, indicating that this second mandate is being actively exercised rather than held dormant. Malta's IDPC is understood to be exercising this dual data-protection and AI Act market-surveillance role ahead of many EEA peer authorities, a structurally significant positioning point for a jurisdiction of Malta's size. #### Outlook How the IDPC operationalises its AI Act market-surveillance duties as the revised implementation timeline takes effect is the principal item to watch for this module going forward. Sources and claims (6) - [ICO](https://ico.org.uk/media2/migrated/4026299/ico-malta-idpc-signed-mou-23062023.pdf) — The IDPC is the national independent supervisory authority responsible for upholding the fundamental right of individuals to have their personal data protected and to monitor the application of data protection law in Malta. - [DataGuidance](https://legacy.dataguidance.com/notes/malta-data-protection-overview) — The Data Protection Act (Chapter 586 of the Laws of Malta), implementing the GDPR, came into effect on 28 May 2018, replacing the former Data Protection Act (Chapter 440). - [DataGuidance](https://legacy.dataguidance.com/notes/malta-data-protection-overview) — Malta applies no national variation to the GDPR definitions of data controller, data processor, personal data, sensitive data, or health data. - [EDPB / IDPC](https://www.edpb.europa.eu/sites/default/files/article-60-final-decisions/publishable_mt_2019-10_right_to_object_marketing_emails_decisionpublic.pdf) — The IDPC has, in prior enforcement matters, investigated and made determinations on whether a controller's main establishment is genuinely located in Malta for GDPR one-stop-shop jurisdictional purposes. - [https://resguard-solutions.com/blog/en/malta-gdpr-data-protection-guide/](https://resguard-solutions.com/blog/en/malta-gdpr-data-protection-guide/) — Information and Data Protection Commissioner (IDPC) — The IDPC is Malta's single national supervisory authority under the Data Protection Act (Cap. 586), entirely distinct from the MFSA. - [RecordingLaw](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/malta-data-privacy-laws/) — Information and Data Protection Commissioner (IDPC) — IDPC is Malta's independent national supervisory authority under GDPR, established under Chapter 586, in force since 28 May 2018. ### Malta: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Direct-effect GDPR bases plus targeted, identified national derogations for insurance/health and credit referencing. Primary framework GDPR Articles 6/7/9, Data Protection Act Cap 586 and subsidiary legislation Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Green Direct-effect GDPR bases plus targeted, identified national derogations for insurance/health and credit referencing. D2 · Lawful Processing — Full Module Record 4 sub-modules · 39 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR direct effect plus active IDPC enforcement/consultation record on subject rights. Primary framework GDPR Articles 12-22; Data Protection Act Cap 586, Article 26 (appeal rights) Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Green GDPR direct effect plus active IDPC enforcement/consultation record on subject rights. #### Sub-modules (5) #### Access RightGreen The GDPR Article 15 access right applies directly; the IDPC launched a public consultation on the data access right in mid-2024. Claims (2): - The IDPC launched a consultation on the data access right for individuals in Malta in mid-2024. - Information and Data Protection Commissioner (IDPC) — The IDPC enforces the GDPR Art.12 one-month subject-access response deadline strictly from date of receipt; routine extension to three months without genuine justification risks a formal finding. #### Rectification And ErasureGreen GDPR Articles 16-17 rectification/erasure rights apply directly with no identified national variation. Claims (2): - GDPR Articles 16 and 17 rectification and erasure rights apply directly in Malta with no identified national variation. - CJEU Advocate General opinion (baptismal registers erasure) — Addresses whether the GDPR Art 17 erasure right may apply to baptismal registers, relevant to Malta's own church/parish record-keeping practice #### Restriction And ObjectionGreen The IDPC has issued a binding decision addressing a controller's handling of a data subject's right to object to direct-marketing emails. Claims (1): - The IDPC issued a decision assessing a controller's compliance with a data subject's right to object to direct marketing emails, examining the controller's establishment and cooperation with the investigation. #### Data PortabilityAmber GDPR Article 20 portability right applies directly; no Malta-specific guidance located beyond the general GDPR text. #### Deadlines And Response WindowsGreen The standard GDPR one-month response window (extendable by two further months for complex requests) applies directly in Malta. Claims (1): - The standard GDPR one-month controller response window, extendable by two additional months for complex requests, applies directly in Malta. Data subject rights (access, rectification, erasure, restriction, objection, portability) apply directly under GDPR Articles 12-22 with no Malta-specific narrowing identified. The IDPC has issued enforcement decisions on the right to object to direct-marketing processing and launched a 2024 consultation on the data access right. No periodic updates recorded in this cycle Sources and claims (6) - [DataGuidance](https://www.dataguidance.com/news/malta-idpc-launches-consultation-data-access-right) — The IDPC launched a consultation on the data access right for individuals in Malta in mid-2024. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) — GDPR Articles 16 and 17 rectification and erasure rights apply directly in Malta with no identified national variation. - [EDPB / IDPC](https://www.edpb.europa.eu/sites/default/files/article-60-final-decisions/publishable_mt_2019-10_right_to_object_marketing_emails_decisionpublic.pdf) — The IDPC issued a decision assessing a controller's compliance with a data subject's right to object to direct marketing emails, examining the controller's establishment and cooperation with the investigation. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) — The standard GDPR one-month controller response window, extendable by two additional months for complex requests, applies directly in Malta. - [VLO Law Firm](https://vlolawfirm.com/legal-updates/malta-2026-q3-data-protection) — Information and Data Protection Commissioner (IDPC) — The IDPC enforces the GDPR Art.12 one-month subject-access response deadline strictly from date of receipt; routine extension to three months without genuine justification risks a formal finding. - [https://idpc.org.mt/](https://idpc.org.mt/) — CJEU Advocate General opinion (baptismal registers erasure) — Addresses whether the GDPR Art 17 erasure right may apply to baptismal registers, relevant to Malta's own church/parish record-keeping practice ### Malta: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive GDPR-direct-effect duties with demonstrated enforcement precedent and sector-specific retention overlay for gambling regulatory data. Primary framework GDPR Articles 5, 24-39; Data Protection Act Cap 586 Article 21 (administrative fines); Retention of Data (Malta Gaming Authority) Regulations (S.L. 583.12) Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Green Comprehensive GDPR-direct-effect duties with demonstrated enforcement precedent and sector-specific retention overlay for gambling regulatory data. D4 · Controller & Processor — Full Module Record 7 sub-modules · 60 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully harmonised EU transfer regime; no Malta-specific derogation or independent adequacy determinations identified. Primary framework GDPR Chapter V (Articles 44-49); Data Protection Act Cap 586, Part V Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Green Fully harmonised EU transfer regime; no Malta-specific derogation or independent adequacy determinations identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 52 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core sectoral overlays (ePrivacy, insurance, gaming, employment, credit) are documented, but financial-services (MFSA) and education-sector specifics were not independently verified in this pass. Primary framework Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01); Retention of Data (Malta Gaming Authority) Regulations (S.L. 583.12); IDPC sectoral guidelines Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Amber Core sectoral overlays (ePrivacy, insurance, gaming, employment, credit) are documented, but financial-services (MFSA) and education-sector specifics were not independently verified in this pass. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 37 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/marketing consent regime is documented; several newer adtech sub-modules (dark patterns, opt-out signals, clean rooms) lack Malta-specific coverage. Primary framework Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01); GDPR Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Amber Cookie/marketing consent regime is documented; several newer adtech sub-modules (dark patterns, opt-out signals, clean rooms) lack Malta-specific coverage. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 38 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Direct GDPR Article 22 effect plus a confirmed, current AI Act competent-authority designation for the IDPC; biometric/genetic-specific and surveillance-carve-out detail remain thinner. Primary framework GDPR Article 22; EU AI Act (Regulation (EU) 2024/1689) Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Green Direct GDPR Article 22 effect plus a confirmed, current AI Act competent-authority designation for the IDPC; biometric/genetic-specific and surveillance-carve-out detail remain thinner. Periodic update · new data 2026-09-05 #### Algorithmic, Biometric & Surveillance Governance As Malta's designated Market Surveillance Authority for high-risk AI systems under the EU AI Act, the IDPC drew attention this cycle to revised EU AI Act implementation timelines following Council approval on 27 July 2026. The IDPC also participated in an AI Act conference hosted at the Malta Digital Innovation Authority on 6 August 2026, indicating sustained institutional engagement with AI Act implementation rather than a single passive announcement of a timeline change. Both developments are non-binding in themselves, reflecting active regulatory engagement rather than a new binding rule, but they mark this module as escalating in this cycle's trajectory assessment. This module sits alongside the IDPC's core GDPR mandate rather than replacing it: the same authority now carries both a data-protection supervisory role and an AI Act market-surveillance role for the specified high-risk use cases of law enforcement, migration and border control, and justice and democracy. No MT-specific AI Act enforcement action was identified this cycle. #### Outlook The practical operationalisation of the revised EU AI Act implementation timeline, and any further IDPC engagement following the 6 August 2026 conference, are the key items to watch for this module next cycle. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 72 words · 7 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core age-of-consent and education-setting derogations are well documented; minor-profiling and dependent-adult protections remain unconfirmed gaps. Primary framework GDPR Article 8; Processing of Personal Data (Protection of Minors) Regulations (Malta subsidiary legislation) Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Amber Core age-of-consent and education-setting derogations are well documented; minor-profiling and dependent-adult protections remain unconfirmed gaps. D9 · Children's Privacy — Full Module Record 5 sub-modules · 64 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Malta: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core enforcement powers, penalty ceiling, and appeal mechanism are well documented; recent (180-day) enforcement activity and regulator funding/capacity data were not located. Primary framework GDPR Articles 58, 77-84; Data Protection Act Cap 586, Articles 21 and 26 Supervisory authority [Office of the Information and Data Protection Commissioner (IDPC)](http://www.idpc.org.mt/) Traffic-light rationale — Amber Core enforcement powers, penalty ceiling, and appeal mechanism are well documented; recent (180-day) enforcement activity and regulator funding/capacity data were not located. Periodic update · new data 2026-10-25 #### Enforcement & Redress Malta's data protection enforcement framework rests on GDPR Article 83 and Data Protection Act Article 21, under which the Information and Data Protection Commissioner may impose administrative fines up to the higher of twenty million euro or four percent of an undertaking's global annual turnover for the most serious infringements. Where the infringing party is a public authority, the fine ceiling drops to twenty-five thousand euro per violation plus twenty-five euro per day of continuing violation, rising to fifty thousand euro plus fifty euro per day for infringements of the categories set out in Article 83(4). This existing ceiling structure is now operating within a newly harmonised calculation framework. The European Data Protection Board adopted, at its plenary on 22 September 2026, a harmonised methodology for calculating administrative fines, together with the final version of its guidelines on the interplay between the Digital Services Act and the GDPR. As a member of the EDPB, the IDPC is understood to be bound to apply this methodology when it calculates any future fine. This is a change to the process by which a fine amount is derived, not a change to the statutory ceilings themselves: the twenty-million-euro-or-four-percent cap, and the lower public-authority caps, remain the outer boundary within which the new methodology operates. No specific IDPC enforcement action applying the new methodology, and no change to the underlying grounds on which the IDPC may find an infringement, was identified. The development is confined to the quantification layer of the enforcement framework. #### Outlook The item to watch is the IDPC's first application of the EDPB's harmonised fining methodology in an actual Maltese enforcement decision, which will show whether harmonisation changes the practical size of fines imposed domestically as well as the process by which they are calculated. Periodic update · new data 2026-10-18 #### Enforcement & Redress Malta's data protection enforcement framework rests on GDPR Article 83 and Data Protection Act Article 21, under which the Information and Data Protection Commissioner may impose administrative fines up to the higher of twenty million euro or four percent of an undertaking's global annual turnover for the most serious infringements. Where the infringing party is a public authority, the fine ceiling drops to twenty-five thousand euro per violation plus twenty-five euro per day of continuing violation, rising to fifty thousand euro plus fifty euro per day for infringements of the categories set out in Article 83(4). This existing ceiling structure is now operating within a newly harmonised calculation framework. The European Data Protection Board adopted, at its plenary on 22 September 2026, a harmonised methodology for calculating administrative fines, together with the final version of its guidelines on the interplay between the Digital Services Act and the GDPR. As a member of the EDPB, the IDPC is understood to be bound to apply this methodology when it calculates any future fine. This is a change to the process by which a fine amount is derived, not a change to the statutory ceilings themselves: the twenty-million-euro-or-four-percent cap, and the lower public-authority caps, remain the outer boundary within which the new methodology operates. No specific IDPC enforcement action applying the new methodology, and no change to the underlying grounds on which the IDPC may find an infringement, was identified this cycle. The development is confined to the quantification layer of the enforcement framework. #### Outlook The item to watch is the IDPC's first application of the EDPB's harmonised fining methodology in an actual Maltese enforcement decision, which will show whether harmonisation changes the practical size of fines imposed domestically as well as the process by which they are calculated. Periodic update · new data 2026-10-12 #### Enforcement & Redress Malta's Information and Data Protection Commissioner has produced two notable enforcement outcomes bearing on this cycle. First, the Court of Appeal confirmed, on 20 May 2026, a Tribunal's earlier reduction of a 2022 administrative fine imposed for breaches of the Article 32 security-principle obligation, with the final confirmed figure settling at EUR200,000 down from the original EUR250,000. This confirms, at the appellate level, that the Tribunal's reduction was sound, and closes out what had been a multi-year dispute over the appropriate penalty for the underlying security failings. The full judgment text was not independently retrieved this cycle; the finding rests on secondary legal commentary describing the appellate outcome, so the precise reasoning behind the confirmed reduction is not yet available from a primary source. Second, a 2026 decision found that an insurance company had breached its duties under the direct-marketing objection regime, having continued to send direct marketing to individuals after they had objected. The Commissioner's response combined a formal reprimand with an order for corrective measures to be completed within twenty days, alongside administrative fines totalling EUR1,000. The modest size of the financial penalty, set against the twenty-day corrective-measures deadline and formal reprimand, suggests the Commissioner's enforcement approach in this category of breach is oriented primarily toward securing behavioural compliance rather than imposing a severe financial deterrent. Taken together, these two matters show continuing enforcement activity by the Commissioner across both a longstanding case reaching its appellate conclusion and a newly decided matter, spanning two different categories of obligation: data security under Article 32, and direct-marketing consent/objection handling. No change to the Commissioner's underlying enforcement powers or procedure was identified this cycle; both matters proceed under the existing framework of the Data Protection Act (Cap. 586). #### Outlook The principal open item is confirmation of the full-text or pinpoint citation for the 2026 insurer direct-marketing decision, which was not independently retrieved this cycle beyond the IDPC's own decisions-page reference. Whether any party pursues further appeal of the now twice-confirmed EUR200,000 security-principle fine is also worth watching, though no indication of a further appeal was identified in the sources reviewed this cycle. Periodic update · new data 2026-10-04 #### Enforcement & Redress Malta's Information and Data Protection Commissioner issued a 2026 decision finding that an insurance company breached its data protection obligations by continuing to process a complainant's personal data for direct marketing purposes after the complainant had objected to such processing. The Commissioner's response combined a reprimand, a corrective-measures order requiring the insurer to take remedial action within 20 days, and administrative fines totalling EUR 1,000. The enforcement mechanism behind this and any similar decision is set out in section 20 of the Data Protection Act, Chapter 586: where the Commissioner imposes an administrative fine, the controller or processor concerned must be ordered in writing to pay it, with the amount due as a civil debt, subject to a right of appeal under section 26; absent an appeal, the decision becomes final and executive. The EUR 1,000 quantum in the 2026 decision sits well below Malta's statutory fine ceilings. Section 21 of Chapter 586 caps a fine on a public authority or body for an Article 83(5) or 83(6) GDPR infringement at EUR 50,000 per violation plus EUR 50 per day of continuation, with correspondingly lower tiers for Article 83(4) infringements; while that specific cap applies to public-sector bodies rather than private insurers, it illustrates that Malta's administrative fines generally continue to be set well short of GDPR's own statutory maxima. Secondary compilation reporting, not independently verified against the Commissioner's own decision text, further describes two 2025 decisions: a EUR 20,000 fine spanning three separate Article 5(1)(a) violations valued at EUR 12,500, EUR 5,000 and EUR 2,500, and a separate EUR 15,000 fine for direct-marketing violations under Articles 21(2) and 5(2) of the GDPR. If accurate, these decisions would reinforce a recurring enforcement interest in direct-marketing practices specifically, consistent with the pattern evident in the verified 2026 decision. #### Outlook The precise date and reference number of the 2026 insurer decision were not confirmed against the Commissioner's own published decision text this cycle, and the two 2025 decisions referenced above rest on a single secondary compilation source rather than independent verification. Confirming these details, and observing whether future decisions move fine quanta closer to the statutory ceiling in cases of recidivist direct-marketing conduct, would sharpen the enforcement-trajectory assessment for this module going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 100 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties