GDPR
Is your organisation GDPR compliant?
The GDPR or ‘General Data Protection Regulation’ (Regulation 2016/679/EU) is a new single EU law dealing with data protection that is intended to do away with the fragmented system that was previously in place and update laws across the EU that have not kept up with the digital age we live in. On 25 May 2018, as in the case of other EU Member States, the GDPR took effect in Malta. The new Data Protection Act, 2018 (Chapter 586 of the Laws of Malta) has also come into effect. Data controllers and processors had until this date to prepare for the various new, and in some cases, onerous obligations introduced by the GDPR.
Maltese organisations (especially those processing large amounts of personal data) must take all necessary measures to ensure full compliance with this new law and this, as soon as possible.
UNDERSTANDING GDPR
GDPR at a glance
- Fines up to €20,000,000 or 4% of an entity’s total worldwide annual turnover
- Significantly expanded territorial scope
- Mandatory data breach notification in certain cases
- Mandatory appointment of a Data Protection Officer in certain cases
- Data Processors now also directly responsible at law
- More stringent consent requirements
- Increased level of information to be provided to data subjects
- More stringent requirements in controller-processor contracts
- Removal of the general notification requirement
- New data subject rights
WHAT WE BELIEVE IN
How can we help?
Our Reputation
Mamo TCV Advocates is a leading Maltese law firm with years of experience in the field of privacy law and, in particular, data protection law. With clients ranging from world-famous multinational IT companies to individual data subjects we can provide your organisation practical advice regardless of the situation you are in.
GDPR Compliance
Over the past years we have carried out several GDPR audits and training sessions for our diverse portfolio of clients and we are now assisting clients with their various new obligations at law. From rules relating to direct marketing to data retention obligations, we have you covered.
What we Offer
- Comprehensive expert legal advisory services
- Data protection risk assessments
- Training of DPOs and other staff members
- Drafting of layered privacy policies & other notices
- Drafting of data processing agreements & addenda
- Full legal representation in contentious matters and/or IDPC investigations
Stay updated with our latest insights
DORA is Now in Force: What’s Next?
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (“DORA” or the “Act”) became enforceable as of 17th January 2025. DORA Resources As highlighted in various DORA insights by our Firm over the last few months (including a very useful overview of DORA itself), DORA represents a significant milestone in aligning the financial services sector with the EU’s digital finance strategy, offering a regulatory framework for operational resilience and ICT risk management. Designed to bolster operational resilience against increasingly sophisticated cyber threats, DORA ushers in a new era…
European Blockchain Sandbox & MDIA Joint Webinar
As previously announced, applications for the third and final cohort of the European Blockchain Sandbox are now open. To find out more on how you can take advantage of this unique scheme, register here to attend this joint webinar being organised by the European Blockchain Sandbox and the Malta Digital Innovation Authority (MDIA) on January 20th at 14:30. The webinar is expected to last around an hour.
The AI Act’s Impact on Businesses Operating Within the EU
This article is part of our EU AI Act series which explores the effect of the AI Act across various industries and sectors. Introduction The first article (see link below) in this EU AI Act series provided, inter alia, a breakdown of the scope, applicability, timeline and risk levels of the AI Act, Regulation (EU) 2024/1689 (hereinafter referred to as the “Act”). The Act introduces significant obligations for all businesses developing or deploying AI that affect persons in the EU, with major fines for non-compliance. Crucially, the Act is extraterritorial in nature, since it also applies to businesses established in…
