Data Protection Update in Malta: Q2 2026

Malta data protection 2026 is entering a more active enforcement phase. The Information and Data Protection Commissioner (IDPC) has sharpened its supervisory focus, the EU';s broader regulatory agenda is filtering into national practice, and businesses operating in Malta face a tighter compliance environment than in previous years. This guide covers the key legislative and regulatory developments of the current quarter, the IDPC';s enforcement priorities, sector-specific obligations that have gained prominence, and the practical steps companies should take to stay compliant.

Malta';s data protection framework is anchored in the General Data Protection Regulation (GDPR), which applies directly as EU law, and the Data Protection Act (Chapter 586 of the Laws of Malta), which supplements the GDPR with national derogations and establishes the IDPC as the competent supervisory authority. For most of its post-GDPR history, Malta';s enforcement record was relatively modest compared to larger EU member states. That picture is changing.

Several converging factors explain the current shift. First, the European Data Protection Board (EDPB) has issued a series of binding decisions and guidelines that national supervisory authorities, including the IDPC, are expected to implement consistently. Second, Malta';s growing profile as a hub for iGaming, financial services, fintech and remote work has brought a larger volume of cross-border data flows under Maltese jurisdiction. Third, the IDPC has received additional resources and has signalled publicly that it intends to move from a predominantly advisory posture to one that includes meaningful corrective action.

In practice, this means that companies which previously relied on informal guidance or low enforcement risk should now treat GDPR compliance as a live operational obligation rather than a one-time documentation exercise.

No wholesale revision of Chapter 586 has been enacted in the current quarter, but targeted amendments have clarified several areas where the national law previously left room for ambiguity. The most significant changes relate to the processing of special categories of data by employers and to the conditions under which public authorities may access personal data held by private entities.

On employment data, the amended provisions tighten the conditions under which employers may process health data, biometric data and data relating to trade union membership. Employers must now document a specific legal basis for each category of sensitive data processed in the employment context, and that documentation must be available for inspection by the IDPC on request. A common mistake among foreign-owned businesses operating in Malta is to rely on group-level data protection policies drafted for another jurisdiction without adapting them to the Maltese national derogations. This approach creates a compliance gap that is increasingly likely to attract scrutiny.

On law enforcement access, the amendments align Malta';s national rules more closely with the requirements established by the Court of Justice of the European Union in its jurisprudence on data retention and access by public authorities. Companies that receive requests for data from Maltese public bodies should ensure they have a documented procedure for assessing the legality of such requests before complying.

The IDPC has published updated guidance on the use of artificial intelligence tools that involve the processing of personal data. While this guidance does not have the force of law, it reflects the IDPC';s current interpretive position and will inform how the authority assesses complaints and conducts investigations.

The guidance addresses three areas in particular. First, it clarifies that the use of AI-driven profiling in commercial contexts - for example, in targeted advertising, credit scoring or recruitment screening - is likely to constitute automated decision-making within the meaning of Article 22 of the GDPR, triggering the right not to be subject to solely automated decisions with significant effects. Second, it sets out the IDPC';s expectation that organisations deploying AI tools will conduct and document a Data Protection Impact Assessment (DPIA) before deployment, not after. Third, it addresses the transparency obligations that apply when individuals are subject to AI-driven decisions, including the requirement to provide meaningful information about the logic involved.

Many businesses underestimate the practical burden of Article 22 compliance. The obligation to provide a human review mechanism is not satisfied by a nominal review process. The IDPC';s guidance makes clear that the human reviewer must have genuine authority to override the automated outcome and must actually exercise that authority where appropriate.

The legal framework for transfers of personal data from Malta to third countries continues to be shaped by EU-level developments. The EU-US Data Privacy Framework remains in place, but businesses should monitor its status carefully, as legal challenges before the Court of Justice of the European Union are ongoing. For transfers to other third countries, Standard Contractual Clauses (SCCs) remain the primary mechanism, supplemented where necessary by transfer impact assessments.

The IDPC has indicated that it will pay particular attention to transfers made by iGaming operators and financial services firms, given the volume and sensitivity of the personal data involved. A non-obvious requirement that frequently catches businesses off guard is the obligation to conduct a transfer impact assessment not only when first implementing an SCC-based transfer arrangement, but also when there is a material change in the legal or factual circumstances of the destination country.

If your organisation transfers personal data outside the EEA and has not reviewed its transfer mechanisms recently, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

The IDPC';s published enforcement activity for the current period reflects a clear prioritisation of three areas: transparency and privacy notices, data subject rights fulfilment, and data breach notification. Each of these areas has generated formal investigations and, in some cases, corrective orders.

On transparency, the IDPC has found that a significant proportion of privacy notices reviewed during proactive audits fail to meet the requirements of Articles 13 and 14 of the GDPR. Common deficiencies include failure to identify all processing purposes, failure to specify the legal basis for each purpose separately, and failure to provide adequate information about data retention periods. The IDPC has issued reprimands and, in more serious cases, orders to bring processing into compliance within a specified timeframe.

On data subject rights, the IDPC has received an increased volume of complaints relating to delayed or inadequate responses to access requests. Under the GDPR, controllers must respond to a Subject Access Request (SAR) within one calendar month, with a possible extension of two further months in complex cases. The IDPC has made clear that the extension must be justified on the specific facts of the case and cannot be used as a default. Businesses that process large volumes of personal data - particularly in the iGaming and financial services sectors - should ensure they have a documented SAR handling procedure with clear internal deadlines.

On data breach notification, the IDPC has noted that a number of organisations are still failing to notify within the 72-hour window required by Article 33 of the GDPR. A common mistake is to delay notification while conducting an internal investigation to determine the full scope of the breach. The GDPR does not require certainty before notification. Organisations should notify the IDPC as soon as they become aware that a breach has likely occurred, providing initial information and updating the notification as more details become available.

Malta';s iGaming sector processes exceptionally large volumes of personal data, including financial data, behavioural data and, in some cases, data relating to problem gambling. The IDPC has coordinated with the Malta Gaming Authority (MGA) to align data protection oversight with the MGA';s licensing and compliance framework. Operators should be aware that a data protection failing identified during an MGA audit may be referred to the IDPC, and vice versa.

In financial services, the IDPC has focused on the intersection between anti-money laundering (AML) obligations and data protection. The Financial Intelligence Analysis Unit (FIAU) requires financial institutions to collect and retain substantial personal data for AML purposes. However, the GDPR';s data minimisation and storage limitation principles still apply. Institutions must ensure that data collected for AML purposes is not repurposed for commercial uses without a separate legal basis, and that retention periods are calibrated to the specific AML requirement rather than set at an indefinite default.

The starting point for any compliance effort is an accurate picture of what personal data your organisation processes, on what legal basis, for what purposes, and with what safeguards. This is the function of a Record of Processing Activities (RoPA), which is mandatory for most organisations under Article 30 of the GDPR.

In practice, many organisations maintain a RoPA that was accurate at the time of initial GDPR implementation but has not been updated to reflect subsequent changes in business operations, technology or data flows. The IDPC has the power to request a RoPA at any time, and an outdated or incomplete record is itself a compliance failing. A practical approach is to schedule a RoPA review at least twice per year, aligned with any significant changes to business processes or systems.

Beyond the RoPA, organisations should review their consent mechanisms, particularly if they use cookies or similar tracking technologies on websites or apps directed at Maltese users. The IDPC';s position on cookie consent is consistent with the EDPB';s guidance: pre-ticked boxes, bundled consent and consent obtained through dark patterns do not constitute valid consent under the GDPR.

A DPIA is required under Article 35 of the GDPR when processing is likely to result in a high risk to the rights and freedoms of individuals. The IDPC has published a list of processing operations for which a DPIA is mandatory in Malta. This list includes systematic monitoring of publicly accessible areas, large-scale processing of special categories of data, and the use of new technologies in ways that have not previously been assessed.

A DPIA is not a one-time exercise. If the processing operation changes materially - for example, if a new AI tool is integrated into an existing process, or if data is shared with a new category of recipient - the DPIA should be reviewed and updated. Many organisations treat the DPIA as a documentation formality rather than a genuine risk assessment. The IDPC';s guidance makes clear that a DPIA must identify specific risks, assess their likelihood and severity, and document the measures taken to mitigate them.

Scenario one: a Malta-based iGaming operator introduces an AI-driven responsible gambling tool that monitors player behaviour in real time and flags potential problem gambling indicators. This processing involves large-scale analysis of behavioural data and automated decision-making with significant effects on individuals. A DPIA is mandatory before deployment, and the operator must also consider its Article 22 obligations and its transparency duties to players.

Scenario two: a financial services firm based in Malta outsources its customer due diligence process to a third-party provider located outside the EEA. This arrangement involves a cross-border data transfer and the appointment of a data processor. The firm must execute a Data Processing Agreement (DPA) with the provider, implement appropriate transfer safeguards, and conduct a transfer impact assessment. It must also update its privacy notice to disclose the transfer and the safeguards in place.

Under Article 37 of the GDPR, certain organisations are required to appoint a Data Protection Officer (DPO). These include public authorities, organisations that carry out large-scale systematic monitoring of individuals, and organisations that process special categories of data on a large scale. In Malta';s business environment, this requirement applies to most iGaming operators, banks, insurance companies and healthcare providers, among others.

A common mistake is to appoint a DPO as a nominal compliance measure without giving that person the resources, access and independence required by the GDPR. The DPO must be involved in all matters relating to the protection of personal data, must have access to senior management, and must not receive instructions regarding the exercise of their tasks. The IDPC has the power to assess whether a DPO appointment is genuine and effective, and has taken action in cases where the DPO role was found to be inadequately resourced.

Organisations that are not required to appoint a DPO should nonetheless consider whether a designated privacy lead or external data protection adviser would strengthen their compliance posture. As the IDPC';s enforcement activity increases, having a clear internal accountability structure becomes a practical risk management measure.

The EU AI Act, which entered into force at the EU level and is being phased in progressively, will have significant implications for organisations that use AI systems in Malta. While the AI Act is a product safety and fundamental rights regulation rather than a data protection law, its requirements overlap substantially with GDPR obligations in areas such as transparency, human oversight and risk assessment.

Organisations that deploy high-risk AI systems - as defined by the AI Act';s Annex III, which covers areas such as employment, credit, education and critical infrastructure - will need to comply with both the AI Act';s conformity requirements and the GDPR';s data protection requirements. In practice, this means that the DPIA conducted for GDPR purposes should be coordinated with the fundamental rights impact assessment required by the AI Act, and that the documentation produced for one purpose should be designed to serve both.

The IDPC has indicated that it will cooperate with the national market surveillance authority designated under the AI Act, and that data protection concerns identified in the context of AI Act enforcement may be referred to the IDPC for follow-up. Businesses should begin mapping their AI systems against the AI Act';s risk categories now, rather than waiting for the relevant provisions to become fully applicable.

The proposed ePrivacy Regulation, which has been under negotiation at the EU level for several years, has not yet been finalised. In the interim, Malta continues to apply the ePrivacy Directive as transposed into national law. The Electronic Communications (Regulation) Act and related subsidiary legislation govern the use of cookies, electronic direct marketing and the confidentiality of electronic communications.

Businesses should be aware that the current ePrivacy rules apply alongside the GDPR, not instead of it. For electronic direct marketing, this means that consent must meet both the ePrivacy standard (opt-in for electronic marketing to individuals) and the GDPR standard (freely given, specific, informed and unambiguous). A single consent mechanism must satisfy both sets of requirements.

The IDPC has received a growing number of complaints relating to unsolicited electronic marketing, and has indicated that it will treat repeated violations as an aggravating factor in any enforcement action. Businesses that conduct email or SMS marketing campaigns directed at Maltese recipients should audit their consent records and suppression list management processes.

To discuss how these developments affect your specific operations, contact info@vlolawfirm.com. We can assist with documents and filings.

The IDPC';s current enforcement priorities - transparency, data subject rights and breach notification - represent the areas of greatest practical risk for most businesses. A privacy notice that does not accurately reflect your processing activities, a failure to respond to a Subject Access Request within the required timeframe, or a delay in notifying a data breach can each result in a formal investigation and corrective order. For regulated businesses in iGaming and financial services, the risk is compounded by the possibility of coordinated action between the IDPC and the relevant sectoral regulator. The most effective risk mitigation is to treat compliance as an ongoing operational process rather than a periodic documentation exercise. Internal audits, staff training and clear escalation procedures for data incidents are the practical foundations of a defensible compliance posture.

The timeline and cost depend heavily on the size and complexity of the organisation and the current state of its data protection practices. For a small or medium-sized business with straightforward processing activities, a structured compliance review and remediation programme can typically be completed within two to three months. For larger organisations with complex data flows, multiple processing systems and cross-border transfers, the process may take six months or more. Professional fees for a comprehensive compliance programme typically start from the low thousands of EUR for smaller engagements and scale upward with complexity. Ongoing costs include DPO services or external advisory retainers, staff training, and the periodic review of documentation. Many businesses underestimate the ongoing cost of maintaining compliance, as distinct from the initial cost of achieving it.

Both options are permissible under the GDPR, and the right choice depends on the organisation';s size, resources and the complexity of its data processing. An in-house DPO offers deeper familiarity with the organisation';s systems and culture, but requires a genuine commitment of resources and must be given the independence required by Article 38 of the GDPR. An external DPO service provider offers flexibility and access to specialist expertise, and can be a cost-effective solution for smaller organisations. The key requirement in either case is that the DPO must have the access, resources and independence to perform their tasks effectively. A nominal appointment that does not meet this standard creates a compliance risk rather than mitigating one. Organisations should document their DPO appointment, including the scope of the role and the reporting line to senior management, and review this documentation periodically.

Malta';s data protection environment is becoming more demanding. The IDPC is more active, the regulatory agenda at EU level is expanding, and the intersection of data protection with AI, financial services and iGaming creates specific compliance challenges for businesses in Malta. Organisations that approach compliance proactively - maintaining accurate records, conducting genuine risk assessments, and building internal accountability structures - are best placed to manage these challenges.

VLO Law Firms advises international clients on data protection matters in Malta. We can assist with compliance reviews, DPIA preparation, DPO services, data transfer arrangements, and regulatory correspondence with the IDPC. To request a consultation, contact: info@vlolawfirm.com