GDPR
Is your organisation GDPR compliant?
The GDPR or ‘General Data Protection Regulation’ (Regulation 2016/679/EU) is a new single EU law dealing with data protection that is intended to do away with the fragmented system that was previously in place and update laws across the EU that have not kept up with the digital age we live in. On 25 May 2018, as in the case of other EU Member States, the GDPR took effect in Malta. The new Data Protection Act, 2018 (Chapter 586 of the Laws of Malta) has also come into effect. Data controllers and processors had until this date to prepare for the various new, and in some cases, onerous obligations introduced by the GDPR.
Maltese organisations (especially those processing large amounts of personal data) must take all necessary measures to ensure full compliance with this new law and this, as soon as possible.
UNDERSTANDING GDPR
GDPR at a glance
- Fines up to €20,000,000 or 4% of an entity’s total worldwide annual turnover
- Significantly expanded territorial scope
- Mandatory data breach notification in certain cases
- Mandatory appointment of a Data Protection Officer in certain cases
- Data Processors now also directly responsible at law
- More stringent consent requirements
- Increased level of information to be provided to data subjects
- More stringent requirements in controller-processor contracts
- Removal of the general notification requirement
- New data subject rights
WHAT WE BELIEVE IN
How can we help?
Our Reputation
Mamo TCV Advocates is a leading Maltese law firm with years of experience in the field of privacy law and, in particular, data protection law. With clients ranging from world-famous multinational IT companies to individual data subjects we can provide your organisation practical advice regardless of the situation you are in.
GDPR Compliance
Over the past years we have carried out several GDPR audits and training sessions for our diverse portfolio of clients and we are now assisting clients with their various new obligations at law. From rules relating to direct marketing to data retention obligations, we have you covered.
What we Offer
- Comprehensive expert legal advisory services
- Data protection risk assessments
- Training of DPOs and other staff members
- Drafting of layered privacy policies & other notices
- Drafting of data processing agreements & addenda
- Full legal representation in contentious matters and/or IDPC investigations
Stay updated with our latest insights
Malta’s Transposition of the NIS 2 Directive: S.L. 460.41
Following Malta’s Draft Order transposing the EU NIS 2 Directive, which closed for public consultation on 7 October 2024, as an EU Member State, Malta was obliged to transpose EU Directive 2022/2555 (‘NIS 2’) by 17 October 2024. The transposition was finally implemented on 8 April 2025 through Legal Notice 71 of 2025 which creates the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 as Subsidiary Legislation 460.41 (S.L. 460.41). It should however be noted that at time of writing, S.L. 460.41 is not yet in force, though it is expected to come…
European Blockchain Sandbox 3rd Cohort & Best Practices Webinar
The selection process for the third and final cohort of the European Blockchain Sandbox has been completed and the final twenty selected use cases have now been announced. Moreover, the European Blockchain Sandbox will soon be publishing the second cohort’s Best Practices Report which shall contain an overview of the regulatory best practices identified. The Report will be launched during a public webinar to be held on the 29th April 2025 at 14:00 CET, wherein the public is invited to ask any questions they may have regarding the Report. In conjunction, the award for the Most Innovative Regulator for the…
European Commission Rejects Draft Regulatory Technical Standards on ICT Subcontracting
The European Commission has communicated its rejection of the draft Regulatory Technical Standards (RTS) on subcontracting ICT services supporting critical or important functions supplementing the Digital Operational Resilience Act (DORA). In its communication, the Commission held that the European Supervisory Authorities (ESAs) exceeded their mandate under Article 30(5) of DORA (which came into effect on 17 January 2025) by introducing requirements not specifically linked to the conditions for subcontracting in Article 5 of the RTS. The Commission has made it clear that Article 5 and the related recital 5 of the draft RTS must be omitted from the draft RTS…
