🇲🇹Data Protection Act (Chapter 586)

← Back to laws in Malta

Data Protection Act (Chapter 586)

Malta applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

Chapter 586 implements and supplements the GDPR in Malta, establishes the IDPC and Appeals Tribunal, and adds national rules for research, identity documents, expression, transfers, penalties and procedure.

National additions and variations

• Subsidiary Legislation 586.11 lowers the GDPR Article 8 age for consent-based information-society services to 13.
• Article 7 requires consultation with and prior authorisation from the Commissioner for specified public-interest processing of genetic, biometric or health data for research or statistics and special-category data used to manage social-care systems.
• Article 8 permits identity-document processing only where clearly justified by secure identification or another valid legal reason and subjects national or general identifiers to appropriate safeguards.
• Article 9 permits expression-related derogations only where compliance is incompatible with the purpose and the processing remains proportionate, necessary and justified by substantial public interest.
• Article 6 conditions research, statistics and public-interest archiving derogations on necessity and safeguards including pseudonymisation, minimisation and use of non-identifying data where possible.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.