Malta Data Protection Act (Cap. 586, 2018)
What Malta's Data Protection Act (Cap. 586) and its subsidiary legislation add to the GDPR: 13 as the age of digital consent, IDPC prior authorisation for public-interest health and genetic research, rules on identity documents and the ID number, research and journalism derogations, sector rules for schools and health insurers, restrictions of data subject rights, the Maltese ePrivacy regulations (cookies, marketing to individuals and companies, telecom breaches, data retention), enforceable SCC rights, the IDPC's DPIA list, and the Commissioner's new Data Act and AI Act roles. Built from the consolidated Maltese texts.
Malta Data Protection Act (Cap. 586, 2018) is a compliance framework from Malta with 6 domains and 25 controls. The largest domains are S.L. 586.01: electronic communications (ePrivacy) and data retention – Malta Data Protection Act (Cap. 586, 2018) (7 controls), S.L. 586.07: the education sector – Malta Data Protection Act (Cap. 586, 2018) (5 controls), Subsidiary legislation on children, health data for insurance and restrictions (S.L. 586.04, 586.09, 586.10, 586.11) – Malta Data Protection Act (Cap. 586, 2018) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Cap. 586 Parts I to IV: scope, derogations, prior authorisation, identity documents, freedom of expression – Malta Data Protection Act (Cap. 586, 2018)
| Code | Title |
|---|---|
| malta-data-protection-act-cap-586-2018::art.6 | Article 6: research, statistics and archiving derogations only with safeguards and only for that purpose |
| malta-data-protection-act-cap-586-2018::art.7 | Article 7: consult and obtain the Commissioner's prior authorisation for public-interest processing of genetic, biometric or health data for research or statistics, and of special categories for social care management |
| malta-data-protection-act-cap-586-2018::art.8 | Article 8: identity documents processed only when clearly justified; the national identity number only under safeguards |
| malta-data-protection-act-cap-586-2018::art.9 | Article 9: freedom of expression and journalistic, academic, artistic or literary processing, exempt only where compliance is incompatible and processing is proportionate |
Cap. 586 Parts V to VIII: the Commissioner, fines, offences, appeals and remedies – Malta Data Protection Act (Cap. 586, 2018)
| Code | Title |
|---|---|
| malta-data-protection-act-cap-586-2018::art.22 | Article 22: give the Commissioner true information and comply with lawful requests in an investigation |
S.L. 586.01: electronic communications (ePrivacy) and data retention – Malta Data Protection Act (Cap. 586, 2018)
| Code | Title |
|---|---|
| malta-data-protection-act-cap-586-2018::SL586.01-18 | S.L. 586.01 Part II regs. 18 to 24: providers retain traffic and location data for six months or one year, disclose only to the Police or Security Service for serious crime, secure and destroy it, and report statistics |
| malta-data-protection-act-cap-586-2018::SL586.01-3A | S.L. 586.01 reg. 3A: providers of public electronic communications services notify breaches to the Commissioner and to affected individuals, and keep an inventory |
| malta-data-protection-act-cap-586-2018::SL586.01-4 | S.L. 586.01 reg. 4: no interception or surveillance of communications and traffic data without the user's consent |
| malta-data-protection-act-cap-586-2018::SL586.01-5 | S.L. 586.01 reg. 5: consent, after clear and comprehensive information, before storing or accessing information on a user's device (cookies) |
| malta-data-protection-act-cap-586-2018::SL586.01-6 | S.L. 586.01 regs. 6 and 7: traffic data erased or anonymised when not needed; billing, marketing and location data only within limits and with consent |
| malta-data-protection-act-cap-586-2018::SL586.01-8 | S.L. 586.01 reg. 8: subscriber directories only with informed consent, limited data and free correction or withdrawal |
| malta-data-protection-act-cap-586-2018::SL586.01-9 | S.L. 586.01 reg. 9: prior written consent for automated calls, fax and e-mail marketing to any subscriber, the customer soft opt-in, and sender identity |
S.L. 586.07: the education sector – Malta Data Protection Act (Cap. 586, 2018)
| Code | Title |
|---|---|
| malta-data-protection-act-cap-586-2018::SL586.07-3 | S.L. 586.07 reg. 3: notify the Commissioner for prior checking of high-risk education processing |
| malta-data-protection-act-cap-586-2018::SL586.07-4 | S.L. 586.07 reg. 4: education authorities request data in writing, need explicit parental consent for special categories, and pseudonymise attainment data |
| malta-data-protection-act-cap-586-2018::SL586.07-5 | S.L. 586.07 reg. 5: educational institutions keep medical and welfare data in separate secure files, destroy them when the student leaves, and obtain consent for images, informal activities and most disclosures |
| malta-data-protection-act-cap-586-2018::SL586.07-6 | S.L. 586.07 regs. 6 and 7: access limited to staff bound by professional secrecy; students of 16 consent for themselves; consent in writing or opt-in; withdrawal deletes |
| malta-data-protection-act-cap-586-2018::SL586.07-8 | S.L. 586.07 reg. 8: research and statistics on student data anonymised or pseudonymised, with consent for external research and IDPC approval for special categories |
Subsidiary legislation on children, health data for insurance and restrictions (S.L. 586.04, 586.09, 586.10, 586.11) – Malta Data Protection Act (Cap. 586, 2018)
| Code | Title |
|---|---|
| malta-data-protection-act-cap-586-2018::SL586.04 | S.L. 586.04: teachers and professionals may process a minor's information in the minor's best interest without parental consent where consent would harm the minor |
| malta-data-protection-act-cap-586-2018::SL586.09-4 | S.L. 586.09 regs. 4 and 7: restricting data subject rights only where necessary for the listed purposes and proportionate |
| malta-data-protection-act-cap-586-2018::SL586.09-5 | S.L. 586.09 regs. 5 and 6: safeguards, retention and informing the data subject of a restriction |
| malta-data-protection-act-cap-586-2018::SL586.10 | S.L. 586.10: health data for insurance treated as substantial public interest, with suitable and specific safeguards |
| malta-data-protection-act-cap-586-2018::SL586.11 | S.L. 586.11: the age of 13 for a child's own consent to information society services |
Transfers, DPIA list and EU instruments (S.L. 586.12, 586.14, IDPC Article 35(4) list) – Malta Data Protection Act (Cap. 586, 2018)
| Code | Title |
|---|---|
| malta-data-protection-act-cap-586-2018::IDPC-DPIA | IDPC Article 35(4) list: the eight kinds of processing that always need a DPIA in Malta |
| malta-data-protection-act-cap-586-2018::SL586.12 | S.L. 586.12: Article 46 transfer instruments must give data subjects third-party beneficiary rights enforceable in Malta as contract |
| malta-data-protection-act-cap-586-2018::SL586.14 | S.L. 586.14 regs. 9 and 10 (in force 2 August 2026): AI providers keep technical documentation for ten years even after insolvency; importers answer the Commissioner in Maltese or English |
What is Malta Data Protection Act (Cap. 586, 2018) and who does it apply to?
Malta Data Protection Act (Cap. 586, 2018) is a compliance framework from Malta with 6 domains and 25 controls. What Malta's Data Protection Act (Cap. 586) and its subsidiary legislation add to the GDPR: 13 as the age of digital consent, IDPC prior authorisation for public-interest health and genetic research, rules on identity documents and the ID number, research and journalism derogations, sector rules for schools and health insurers, restrictions of data subject rights, the Maltese ePrivacy regulations (cookies, marketing to individuals and companies, telecom breaches, data retention), enforceable SCC rights, the IDPC's DPIA list, and the Commissioner's new Data Act and AI Act roles. Built from the consolidated Maltese texts. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Malta Data Protection Act (Cap. 586, 2018) actually require?
Malta Data Protection Act (Cap. 586, 2018) has 25 controls organised across 6 domains. The largest domains are S.L. 586.01: electronic communications (ePrivacy) and data retention – Malta Data Protection Act (Cap. 586, 2018) (7 controls), S.L. 586.07: the education sector – Malta Data Protection Act (Cap. 586, 2018) (5 controls), Subsidiary legislation on children, health data for insurance and restrictions (S.L. 586.04, 586.09, 586.10, 586.11) – Malta Data Protection Act (Cap. 586, 2018) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Malta Data Protection Act (Cap. 586, 2018) do I already cover?
Malta Data Protection Act (Cap. 586, 2018) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Malta Data Protection Act (Cap. 586, 2018)?
Start your Malta Data Protection Act (Cap. 586, 2018) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Malta Data Protection Act (Cap. 586, 2018) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required