MaltaGDPR Articles 82-83 and IDPC Enforcement in Malta
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Data Protection Act (Cap. 586) Article 22 makes it a criminal offence, separate from the Commissioner's administrative fines, for a person to knowingly provide false information to the Commissioner when required under his Article 58 GDPR investigative powers, or to fail to comply with a lawful request made in the course of a Commissioner investigation. On conviction the penalty is a fine (multa) of not less than EUR 1,250 and not more than EUR 50,000, or imprisonment for up to six months, or both.
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for a private-sector undertaking. The Data Protection Act (Cap. 586) Article 21 sets a lower, Malta-specific ceiling that applies only to a public authority or body: up to EUR 25,000 per violation plus a daily fine of up to EUR 25 for an Article 83(4)-tier infringement, and up to EUR 50,000 per violation plus a daily fine of up to EUR 50 for an Article 83(5) or 83(6)-tier infringement.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information and Data Protection Commissioner (IDPC), Malta's supervisory authority under the GDPR and the Data Protection Act (Cap. 586).
Enforcement record
Counts the administrative fines the report narrates for calendar year 2024, the latest annual report published: a EUR 15,000 fine (, unsolicited direct marketing, Articles 21(2) and 5(2)) described in section 6.7, and a EUR 2,500 fine (access-request and transparency failures, Articles 13-15) described in section 6.3, for a total of EUR 17,500. The report also states other administrative fines were collected in 2024 following final judgments on cases the Commissioner concluded in prior years, without giving their count or amount, so this likely understates total 2024 collections; it gives no summary table of the year's total fines or actions the way some larger DPAs do. Public enforcement actions only; no private civil claim count is published.
- As of
- Trend
- Flat
- Currency
- EUR
- Source link
- https://idpc.org.mt/wp-content/uploads/2025/09/IDPC-Annual-Report-2024-Final.pdf
- Fines per year
- 17,500
- Actions per year
- 2
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Maltese rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation, and Article 83 sets the administrative fines. Neither states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation. Article 21 of the Data Protection Act sets fines for public authorities and names no record.
- Kind
- None
- As of
What this law does
The IDPC is the supervisory authority and enforces General Data Protection Regulation (GDPR) fines up to EUR 20 million or 4 percent of global annual turnover for private-sector controllers and processors. Cap. 586's own Article 21 (Administrative fines on public authorities or bodies) sets a Malta-specific ceiling for the public sector, distinct from the private-sector maximum.
A public authority or body faces a EUR 25,000 per-violation cap plus a EUR 25 daily fine for infringements of the Article 83(4) tier, and a EUR 50,000 per-violation cap plus a EUR 50 daily fine for infringements of the Article 83(5) or 83(6) tier. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .