Malta

Article 4(2) of the Data Protection Act (Chapter 586 of the Laws of Malta) covers three cases. First, you use or store personal data through a business you have in Malta, or through a Maltese Embassy or High Commission abroad. That applies wherever the data is actually handled. Second, you are based outside the European Union and you handle data about people who are in Malta, because you offer them goods or services or watch their behaviour in Malta. Third, you are based outside the European Union, in a place where Maltese law applies under international law. The duty to appoint a representative comes from Article 27 of the European privacy rules. Malta adds none of its own.

Sector by sector, checked 18 August 2026. ONLINE GAMING - data can leave only if conditions are met This is the tightest storage rule in the country. Article 17 of the Malta Gaming Authority's Gaming Authorisations and Compliance Directive (Directive 3 of 2018, version 2 of October 2021) says the key technical setup must be located in Malta, or in another Member State of the European Union or the European Economic Area. The Authority can allow other locations case by case if it is satisfied the protection is just as good. It can also allow a spread-out setup where geography does not matter. The key technical setup includes the player database, the financial database, the gaming database, the control system, the random number generators and the jackpot parts. You must also keep a live mirror server for essential regulatory data. The Authority must be able to reach it at all times, including in person. COMPANIES OF ANY INDUSTRY - a copy must stay in the country Article 163(3) of the Companies Act lets you keep accounting records anywhere. If you keep them outside Malta, you must send accounts and returns to a place in Malta and keep them there. They must show the financial position at least every six months. GOVERNMENT - data can leave only if conditions are met The Government of Malta Cloud Services Policy (GMICT P 0124, version 1.0, effective 13 September 2024) says cloud services should normally be provided within the European Union or European Economic Area. Anything that stores, uses, sends or shares classified information must use the Government's own cloud through its agent. BANKING - we found no rule that data must stay in Malta. The Banking Act only says a credit institution must tell the regulator before it outsources important services (article 19A). PAYMENTS, INSURANCE, SECURITIES - we found no rule that data must stay in Malta. The European financial resilience rules known as DORA apply. They make you say where data is handled. They do not make it stay anywhere. HEALTH - we found no rule that data must stay in Malta, either in the Health Act (Chapter 528) or in the health data rules. Malta's health-specific data rule (S.L. 586.10) is about insurance, not about where data sits. TELECOMS - we found no rule that data must stay in Malta. The old blanket rules on keeping call records are still printed in the law but cannot be enforced (see the rules list). EDUCATION, MAPPING AND GEOSPATIAL, DEFENCE - we found no rule about where data must be stored.

You can only send data to approved countries, and that approved list is run at European Union level, not by Malta. Malta's own rules work like this. Article 10 of the Data Protection Act lets the Minister, after consulting the Commissioner, make regulations limiting transfers of specific types of personal data outside Europe or to an international organisation, for important reasons of public interest. We found no such regulations in force on the official statute site on 18 August 2026. The power sits unused. Malta's two older transfer rules are gone. The Third Country (Data Protection Act) Regulations (S.L. 586.03) were repealed by Legal Notice 298 of 2019. The Transfer of Personal Data to Third Countries Order (S.L. 586.05) was repealed by Legal Notice 296 of 2019. What remains is S.L. 586.12 (Legal Notice 204 of 2023). It puts the 2021 European standard contract clauses into Maltese law. It also gives the Commissioner power to enforce the rules on transfers. Online gaming has its own separate route. Hosting outside the European Economic Area needs the Malta Gaming Authority's approval, case by case.

The Prime Minister appoints the Commissioner on the advice of Cabinet, after consulting the Leader of the Opposition (Data Protection Act, article 11). The office publishes every binding decision on its own site. The 2026 entries include an order, a reprimand and two fines against an insurance company for ignoring a marketing objection. The largest fine on the published register is 250,000 euros (about $288,000). A well-known earlier case fined a data analytics company 65,000 euros (about $75,000). The office also decides freedom of information complaints. One caveat on capacity. As of 18 August 2026 the most recent annual report published is for 2024, uploaded in April 2026. So the office does not publish current-year statistics. Other regulators that act here: the Malta Gaming Authority, whose public enforcement register shows repeated cancellations and suspensions of licences in 2024 and 2025; the Malta Financial Services Authority for banks, insurers and investment firms; the Critical Infrastructure Protection Department and CSIRTMalta for cyber incidents since 23 January 2026; and the Malta Communications Authority for telecoms.

WHAT YOU MUST KEEP. Companies Act article 163(5): keep accounting records for ten years. Where they are in bound or unified form, the ten years run from the last entry. Failure is a crime for every officer in default. Value Added Tax Act article 48: keep records and accounts for at least six years from the end of the year. Prevention of Money Laundering and Funding of Terrorism Regulations (S.L. 373.01), regulation 13: five years, and this can be extended. Old telecoms rules requiring six months of internet records and twelve months of telephone records are still printed in S.L. 586.01. They cannot be enforced as a blanket duty (see the rules list). The gaming rulebook adds its own. A licensee must give the holder of a dormant account a final notice. It may not take the remaining money any sooner than five years from that notice. Audit logs of changes to the key technical setup must be kept for at least two years. WHAT YOU MUST DELETE. The European rules say you keep personal data only as long as you need it. The Commissioner enforces that. One Maltese rule runs the other way. Article 55 of the Gaming Act says that despite any other law, including the Data Protection Act, the Malta Gaming Authority may keep any information, including personal information, for as long as it thinks necessary 'or indefinitely as the case may be'. The Authority's own retention rules (S.L. 583.12) set a default of ten years after the data stops being needed.

CLOCK 1 - personal data. The European rule: tell the Information and Data Protection Commissioner within 72 hours of finding out. Tell the affected people without undue delay where the risk to them is high. CLOCK 2 - cyber incidents. Malta's version of the European network security rules has been in force since 23 January 2026. If you are an essential or important organisation, you must give the national computer security team an early warning without undue delay. That must happen within 24 hours of finding out about a significant incident. A fuller report follows within 72 hours. A final report follows within one month. The same organisations must sign themselves up on a national self-registration system run by the Critical Infrastructure Protection Department. CLOCK 3 - telecoms. If you provide public electronic communications services, you must tell the Commissioner about a personal data breach without undue delay. You must also tell the subscriber where the breach is likely to harm them. The European rule that applies directly to this sector sets that at 24 hours. Financial firms have a fourth deadline under the European financial resilience rules known as DORA. Gaming licensees must report certain incidents to the Malta Gaming Authority. Nothing in Maltese law lines these up.

1. AGE THIRTEEN. Malta picked the lowest age Europe allows. A child can agree to an online service at thirteen (S.L. 586.11, Legal Notice 179 of 2018). If you build to a sixteen-or-parental-consent rule, you are stricter than Malta requires. If you build to a global thirteen rule, you are too loose for most other European countries. Neither default works across Europe. 2. YOU NEED PERMISSION FIRST, NOT JUST A RISK ASSESSMENT. Article 7 of the Data Protection Act says you must ask the Commissioner and get written permission before you start. This covers genetic data, biometric data or health data used for statistics or research in the public interest. It also covers special categories of data used to manage social care services. For research the Commissioner must also consult a research ethics committee. You have to wait for this permission. There is no European equivalent. 3. IDENTITY DOCUMENTS. Article 8 says you may only use an identity document where the purpose and the need for secure identification clearly justify it. You may only use the national identity number with proper safeguards. Routine 'send us a photo of your ID card' sign-up is not automatically legal in Malta. 4. YOU CAN GO TO PRISON, TWO WAYS. First, the Professional Secrecy Act extends the Criminal Code's secrecy offence to a long list of people. That list covers staff and officers of banks and financial institutions, insurers, accountants, auditors, lawyers, notaries, doctors, psychologists, social workers and state employees. So a badly run cloud migration that exposes client information is a criminal matter. It can only be prosecuted with the Attorney General's sanction. Second, article 22 of the Data Protection Act makes it an offence to give the Commissioner false information, or to fail to cooperate with an investigation. The penalty is a fine of 1,250 to 50,000 euros (about $1,400 to $58,000) or six months in prison, or both. 5. PUBLIC BODIES ARE CHEAP TO FINE. Article 21 caps fines on a public authority at 25,000 euros (about $29,000) per breach for the lower tier and 50,000 euros (about $58,000) for the higher tier. There is also a daily payment of 25 or 50 euros. If you deal with a Maltese public authority, the pressure on them to comply is small. 6. THE GAMING RETENTION OVERRIDE. Article 55 of the Gaming Act lets the Malta Gaming Authority keep personal information forever. It expressly overrides the Data Protection Act. Nobody has yet tested whether that survives a challenge under the European rules.

DATED CHANGES. 1 January 2027 - the Protection against Adverse Consequences for Persons who recovered from Oncological Diseases (Right to be Forgotten) Act (Chapter 657, Act X of 2026) comes into force. It stops anyone offering a life insurance contract, a bank loan, an employment contract or a related agreement from asking for or using a person's cancer history. That applies once a set period has passed since treatment ended. It also sets up a Review Board. This is a flat ban on using a type of health data, not a paperwork exercise. 12 January 2027 - the European Data Act makes cloud switching and data export free of charge. Malta gave the Information and Data Protection Commissioner the job of enforcing the Data Act, in S.L. 586.13 (Legal Notice 223 of 2025, in force 10 October 2025). Fines follow the European privacy penalty scale. 2 August 2026 - most of Malta's artificial intelligence rules (S.L. 586.14, Legal Notice 227 of 2025) started. They name the Commissioner as the authority that polices the market. On 27 July 2026 the Commissioner said publicly that European timelines had moved. High-risk standalone systems moved to 2 December 2027 and regulatory sandboxes to 2 August 2027. Transparency labelling stayed at 2 August 2026. Through 2026 - the network security order and the critical entities resilience order both started on 23 January 2026. Both are in their first year of supervision. The duty to self-register is new and we have not yet seen it enforced. POWERS THE GOVERNMENT ALREADY HOLDS, usable with no consultation. 1. Article 10 of the Data Protection Act: the Minister may make regulations limiting transfers of named types of personal data outside Europe, for important reasons of public interest. Never used. This is the only way Malta could impose its own limit on sending data abroad, and it needs no debate in parliament. 2. Article 5 and S.L. 586.09: the Minister may limit people's rights for national security, tax, social security and other listed reasons. 3. The Malta Gaming Authority decides case by case whether to allow hosting outside the European Economic Area. It can refuse or withdraw that permission. 4. The old telecoms retention rules have never been repealed. They could be brought back in a narrower form at any time.