Malta

Article 4(2) of the Data Protection Act (Chapter 586 of the Laws of Malta) applies the Act to (a) processing in the context of an establishment of a controller or processor in Malta, or in a Maltese Embassy or High Commission abroad, regardless of where the processing happens; (b) processing of people who are in Malta by a controller or processor not established in the European Union, where the activity is offering goods or services to them or monitoring their behaviour in Malta; and (c) processing by a controller not established in the Union but in a place where Maltese law applies by public international law. Article 27 GDPR (bloc layer) supplies the representative duty; Malta adds none of its own.

Sector by sector, checked 18 August 2026. ONLINE GAMING — data can leave with the right paperwork, and the tightest wall in the country. Under article 17 of the Malta Gaming Authority's Gaming Authorisations and Compliance Directive (Directive 3 of 2018, version 2 of October 2021), 'the key technical setup shall be located in Malta or in another Member State of the European Union or the European Economic Area'. The Authority may allow other locations case by case where it is satisfied they offer equivalent safeguards, and may allow a decentralised setup where geography is irrelevant. Key technical setup expressly includes the player database, the financial database, the gaming database, the control system, the random number generators and the jackpot components. A live or real-time mirror server for essential regulatory data must be kept readily accessible to the Authority at all times, including physically. COMPANIES OF ANY INDUSTRY — a copy must stay in the country. Article 163(3) of the Companies Act allows accounting records to be kept anywhere, but if they are kept outside Malta, accounts and returns disclosing the financial position at intervals of no more than six months must be sent to, and kept at, a place in Malta. GOVERNMENT — data can leave with the right paperwork. The Government of Malta Cloud Services Policy (GMICT P 0124, version 1.0, effective 13 September 2024) says cloud services used shall as a rule be those provided within the European Union or European Economic Area, and that anything storing, processing, transmitting or sharing classified information must use the Government's own cloud through its agent. BANKING — no localisation found. The Banking Act only requires a credit institution to inform the regulator before outsourcing material services (article 19A). PAYMENTS, INSURANCE, SECURITIES — no localisation found; the European financial resilience regulation known as DORA governs, and it requires disclosure of where data is processed but does not require it to stay anywhere. HEALTH — no localisation found in the Health Act (Chapter 528) or in the health-sector data regulations. Malta's health-specific data rule (S.L. 586.10) concerns insurance, not storage location. TELECOMS — no localisation found. The old blanket call-record retention rules are still printed in the law but are unenforceable (see the rules list). EDUCATION, MAPPING AND GEOSPATIAL, DEFENCE — no storage-location rule found.

The model is an allowlist run at European Union level, not a Maltese one. Malta's own instruments: article 10 of the Data Protection Act lets the Minister, after consulting the Commissioner, set limits by regulations on transferring specific categories of personal data to a third country or an international organisation for important reasons of public interest. No such regulations were found in force on the official statute site on 18 August 2026 — this is a dormant switch. Malta's two pre-2018 transfer instruments are gone: the Third Country (Data Protection Act) Regulations (S.L. 586.03) were repealed by Legal Notice 298 of 2019, and the Transfer of Personal Data to Third Countries Order (S.L. 586.05) by Legal Notice 296 of 2019. What remains is S.L. 586.12 (Legal Notice 204 of 2023), which implements the 2021 European standard contractual clauses and gives the Commissioner enforcement powers over transfers. Online gaming has its own, separate permission route: hosting outside the European Economic Area needs the Malta Gaming Authority's case-by-case approval.

The Commissioner is appointed by the Prime Minister on the advice of Cabinet after consulting the Leader of the Opposition (Data Protection Act, article 11). Observable evidence of activity: the office publishes every binding decision on its own site, with 2026 entries including an order, a reprimand and two fines against an insurance company for ignoring a marketing objection. The largest fine on the published register is 250,000 euros (about $288,000); a well-known earlier case fined a data analytics company 65,000 euros (about $75,000). The office also decides freedom of information complaints. One caveat on capacity: as of 18 August 2026 the most recent annual report published is for 2024, uploaded in April 2026, so current-year statistics are not available from the office itself. Other regulators that actually bite: the Malta Gaming Authority, whose public enforcement register shows repeated cancellations and suspensions of licences in 2024 and 2025; the Malta Financial Services Authority for banks, insurers and investment firms; the Critical Infrastructure Protection Department and CSIRTMalta for cyber incidents since 23 January 2026; and the Malta Communications Authority for telecoms.

FLOOR. Companies Act article 163(5): accounting records kept for ten years, and where they are in bound or unified form the ten years run from the last entry; failure is a criminal offence for every officer in default. Value Added Tax Act article 48: records and accounts retained for at least six years from the end of the year. Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01), regulation 13: five years, extendable. Old telecoms retention of six months for internet records and twelve months for telephone records is still printed in S.L. 586.01 but is unenforceable as a blanket duty (see the rules list). The gaming rulebook adds its own: a licensee must give a dormant-account holder final notice and may not appropriate remaining funds sooner than five years from that notice, and audit logs of changes to the key technical setup must be kept for at least two years. CEILING. The storage limitation principle in the European rules, enforced by the Commissioner. One striking Maltese exception runs the other way: article 55 of the Gaming Act says that notwithstanding any other law, including the Data Protection Act, the Malta Gaming Authority may retain any information, including personal information, for as long as it thinks necessary 'or indefinitely as the case may be'. The Authority's own retention regulations (S.L. 583.12) set a default of ten years after the data stops being necessary.

CLOCK 1 — personal data. The European rule: notify the Information and Data Protection Commissioner within 72 hours of becoming aware, and tell affected people without undue delay where the risk to them is high. CLOCK 2 — cyber incidents. Malta's version of the European network security rules, in force since 23 January 2026, requires an essential or important entity to give the national computer security team an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within one month. The same entities must sign themselves up on a national self-registration mechanism run by the Critical Infrastructure Protection Department. CLOCK 3 — telecoms. A provider of publicly available electronic communications services must notify the Commissioner of a personal data breach without undue delay, and the subscriber too where the breach is likely to affect them adversely. The directly applicable European rule for this sector sets that at 24 hours. Financial firms have a fourth clock under the European financial resilience regulation known as DORA, and gaming licensees must report certain incidents to the Malta Gaming Authority. Nothing in Maltese law harmonises these.

1. AGE THIRTEEN. Malta used the lowest option Europe allows. A child can consent to an online service at thirteen (S.L. 586.11, Legal Notice 179 of 2018). A product built to a sixteen-or-parental-consent rule is over-restrictive in Malta; a product built to a global thirteen rule is under-restrictive in most other European countries. Neither default is right across Europe. 2. PRIOR PERMISSION, NOT JUST A RISK ASSESSMENT. Article 7 of the Data Protection Act says a controller must consult and obtain prior authorisation from the Commissioner before processing, in the public interest, genetic data, biometric data or health data for statistical or research purposes, or special categories of data for managing social care services. For research the Commissioner must also consult a research ethics committee. This is a permission you wait for, and it has no European equivalent. 3. IDENTITY DOCUMENTS. Article 8 says an identity document may only be processed where clearly justified by the purpose and the importance of secure identification, and the national identity number may only be used with appropriate safeguards. Routine 'send us a photo of your ID card' onboarding is not automatically lawful in Malta. 4. CRIMINAL LIABILITY, TWO WAYS. First, the Professional Secrecy Act extends the Criminal Code's secrecy offence to a long list of people including employees and officers of banks and financial institutions, insurers, accountants, auditors, lawyers, notaries, doctors, psychologists, social workers and state employees — so a badly controlled cloud migration that exposes client information is a criminal matter, prosecutable only with the Attorney General's sanction. Second, article 22 of the Data Protection Act makes it an offence to give the Commissioner false information or to fail to comply with an investigation: a fine of 1,250 to 50,000 euros (about $1,400 to $58,000) or six months in prison, or both. 5. PUBLIC BODIES ARE CHEAP TO FINE. Article 21 caps administrative fines on a public authority at 25,000 euros (about $29,000) per violation for the lower tier and 50,000 euros (about $58,000) for the higher tier, plus a daily payment of 25 or 50 euros. If your counterparty is a Maltese public authority, the deterrent on them is small. 6. THE GAMING RETENTION OVERRIDE. Article 55 of the Gaming Act lets the Malta Gaming Authority keep personal information indefinitely, expressly overriding the Data Protection Act. Whether that survives a challenge under the European rules has not been tested.

DATED CHANGES. 1 January 2027 — the Protection against Adverse Consequences for Persons who recovered from Oncological Diseases (Right to be Forgotten) Act (Chapter 657, Act X of 2026) comes into force. It bars a party offering a life insurance contract, bank loan, employment contract or ancillary agreement from requiring or using a person's oncological medical history once an established period has passed since the end of treatment, and sets up a Review Board. This is a hard prohibition on using a category of health data, not a paperwork exercise. 12 January 2027 — the European Data Act's zero cloud-switching and egress charges bite. Malta gave the Information and Data Protection Commissioner the national enforcement role for the Data Act in S.L. 586.13 (Legal Notice 223 of 2025, in force 10 October 2025), with fines under the European privacy penalty scale. 2 August 2026 — most of Malta's artificial intelligence regulations (S.L. 586.14, Legal Notice 227 of 2025) commenced, designating the Commissioner as market surveillance authority. On 27 July 2026 the Commissioner publicly flagged that European timelines had moved: high-risk standalone systems pushed to 2 December 2027 and regulatory sandboxes to 2 August 2027, while transparency labelling stayed at 2 August 2026. Through 2026 — the network security order (in force 23 January 2026) and the critical entities resilience order (also 23 January 2026) are both in their first supervisory year; the self-registration duty is new and enforcement has not yet been observed. DORMANT SWITCHES — powers already held, usable with no consultation. 1. Article 10 of the Data Protection Act: the Minister may by regulations set limits on transferring specific categories of personal data to a third country for important reasons of public interest. Never used. This is the only route by which Malta could impose its own data-export restriction, and it needs no parliamentary debate. 2. Article 5 and S.L. 586.09: the Minister may restrict individuals' rights for national security, tax, social security and other listed grounds. 3. Malta Gaming Authority approval of non-European hosting is discretionary and case by case; it can be refused or withdrawn. 4. The unrepealed blanket telecoms retention rules could be revived by re-enactment in a targeted form at any time.