Skip to main content

Data Protection Laws

Return to GDPR page

Current European Union Data Protection Legislation

  • GDPR
    Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
  • ePrivacy
    Directive Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on Privacy and Electronic Communications)
  • Directive on the Processing of Personal Data by Competent Authorities
    Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA
  • Passenger Name Record Directive
    Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime

Current Local Data Protection Legislation

Proposed European Union Data Protection Legislation


ePrivacy Regulation (European Parliament proposal) *

Published on 4th May 2018
Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)

*Although these draft texts have been published, they do not form part of the European Union Acquis Communautaire yet since they are still subject to amendments.

Stay updated with our latest insights

Explore Insights
AI Act’s Impact on Businesses Operating Within the EU
Data Protection and Privacy

AI Laws of the World: Mamo TCV Contributes to the First Edition of DLA Piper’s Comparative Guide

DLA Piper’s recently published ‘AI Laws of the World’ guide provides a 2025 Q3 snapshot of AI laws and proposed regulations across more than 40 countries (including all 27 EU Member States), highlighting key legislative developments, regulations, proposed bills, and guidelines issued by governmental bodies. The guide also includes a contribution made by Mamo TCV Advocates which illustrates the legal position in Malta. The guide underscores significant geographical variation in regulatory approaches and attitudes, yet also reveals numerous common concerns, with lawmakers and AI-focused organisations worldwide adopting and exchanging a variety of strategies. Whilst some jurisdictions have established their own…
Malta's AI Act
Data Protection and Privacy

Malta’s AI Act Authority Designations

The Malta Digital Innovation Authority (“MDIA”) and the Information Data Protection Commission (“IDPC”) have been identified as the Maltese Market Surveillance Authorities (“MSA”) under EU Regulation 2024/1689 (the “AI Act”), albeit the process of designation has yet to be formally concluded. It is expected that this will take place shortly in the coming days. The MSAs will be tasked with overseeing the responsible use of AI systems in Malta and with having the competence to carry out investigations and issue fines and penalties where necessary. They will have a diverse set of responsibilities that may be categorised as follows: Maintaining…
Penetration Testing
DORA

Threat-Led Penetration Testing Regulatory Technical Standards under DORA Take Effect

As of today, 8 July 2025, the Regulatory Technical Standards (RTS) on Threat-Led Penetration Testing (TLPT) are now effective, including in Malta, following their publication in the Official Journal on 18 June 2025. These RTS supplement Article 26 of the Digital Operational Resilience Act (‘DORA’) and lay down a framework for the execution of TLPT. The RTS specify the criteria used for identifying the financial entities which are required to perform threat-led penetration tests and lay down organisational arrangements for financial entities. The RTS also include provisions on risk management and specify criteria for engaging TLPT providers. Moreover, the RTS…
Traffic warning
DORA
DORA ICT Subcontracting RTS Published
Digital Inclusion
Telecoms, Media & Technology
Digital Inclusion: The European Accessibility Act and the Web Accessibility Directive
Chain
Telecoms, Media & Technology
Malta’s Transposition of the NIS 2 Directive: S.L. 460.41

Join our mailing list

Get in touch by sending us a message or by contacting us directly.


How can we help you?

Contact us