Data protection & privacy law in Malta (2026)

Legal framework

GDPR (EU) 2016/679 directly applicable; Malta Data Protection Act 2018 (Chapter 586, Laws of Malta); supervised by the Information and Data Protection Commissioner (IDPC)

GDPR & data protection in Malta

In Malta, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Information and Data Protection Commissioner (IDPC).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Information and Data Protection Commissioner (IDPC)

Applies to

any organisation processing the personal data of people in Malta, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Malta supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Malta

1. 01Primary national implementing law

   The Data Protection Act 2018 (Act XX of 2018), codified as Chapter 586 of the Laws of Malta, repealed the previous Chapter 440 and entered into force on 28 May 2018 to complement GDPR. It is accompanied by eleven subsidiary regulations covering specific processing contexts.

   idpc.org.mt idpc.org.mt

2. 02Supervisory authority, IDPC

   The Information and Data Protection Commissioner (IDPC) is Malta's sole data-protection supervisory authority under Chapter 586. Dr Reno Borg took the oath of office on 22 April 2026 for a new five-year term, succeeding Ian Deguara.

   idpc.org.mt justice.gov.mt

3. 03Key national derogations

   Malta exercised GDPR derogations in subsidiary legislation: SL 586.11 lowers the age of digital consent to 13 (GDPR Art. 8 permits 13-16); SL 586.10 permits health-data processing for insurance purposes; derogations for freedom of expression and journalistic/research/archival purposes are also enacted.

   eu-rep.global whitecase.com

4. 04Law Enforcement Directive implementation

   SL 586.08 transposes Directive 2016/680 (Law Enforcement Directive) into Maltese law, governing personal-data processing by competent authorities for criminal justice purposes, with the IDPC designated as the monitoring authority.

   idpc.org.mt idpc.org.mt

5. 05Enforcement record

   The IDPC actively issues fines: the largest recorded was €65,000 against C-Planet for a data breach involving special-category data. For public authorities, fines are capped at €25,000 per violation (doubling to €50,000 for serious cases) plus daily penalties; private entities face standard GDPR maximums (up to 4 % global turnover / €20 million).

   dataguidance.com noyb.eu pwc.com

6. 06AI Act intersection with data protection

   Under Malta's AI Act implementation framework, the IDPC is designated as market surveillance authority for high-risk AI systems touching biometrics, law enforcement, migration/border control, and the administration of justice, with powers effective from 2 August 2026.

   chambers.com mondaq.com

GDPR in Malta: FAQ

Timeline of decisions

1. 1 Jan 2022Enforcement
   IDPC Fines C-Planet €65,000 for Voter-Database Breach

   The Information and Data Protection Commissioner imposed a €65,000 fine on IT company C-Planet after finding it had failed to implement adequate technical and organisational security measures, resulting in the 2020 exposure of 337,000 voters' records. This was one of the largest GDPR enforcement actions in Malta to that date.

   DataGuidance (citing IDPC decision)

2. 25 May 2018Law · official
   GDPR Applies; Malta Enacts Data Protection Act (Cap. 586)

   The GDPR began applying directly in Malta and was supplemented by Act XX of 2018 (Chapter 586), establishing the Information and Data Protection Commissioner (IDPC) as the independent supervisory authority. Controllers became subject to 72-hour breach notification to the IDPC and up to €20 million / 4 % of turnover fines for serious infringements, creating the first binding cybersecurity-adjacent breach reporting duty in Malta.

   Information and Data Protection Commissioner (IDPC)

Sources

1. 1.idpc.org.mt/wp-content/uploads/2020/07/CAP-586.pdf
2. 2.idpc.org.mt/our-office/legislation/
3. 3.idpc.org.mt/
4. 4.justice.gov.mt/public-bodies/idpc/
5. 5.eu-rep.global/mt-compare-privacy-laws
6. 6.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-malta
7. 7.dataguidance.com/news/malta-idpc-fines-c-planet-65000-data-breach
8. 8.noyb.eu/en/data-breach-malta-65000-eu-fine-c-planet
9. 9.pwc.com/mt/en/publications/tax-legal/data-protection-sanctions.html
10. 10.chambers.com/articles/malta-s-ai-act-framework-the-new-roles-of-the-mdia-and-idpc
11. 11.mondaq.com/new-technology/1691634/maltas-ai-act-framework-the-new-roles-of-the-m
12. 12.dlapiperdataprotection.com/?t=law&c=MT