Cybersecurity law in Malta: NIS2 compliance (2026)

Legal Notice 89 of 2026 amends S.L. 460.41 by replacing the original Advisory Board with a fully empowered Enforcement Committee authorised to issue administrative penalties, repositions the national CSIRT under MITA, and tightens auditor-independence requirements. This operationalised meaningful sanctions under the NIS2 framework.

Malta's Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 took effect, transposing Directive 2022/2555, five months after the EU's 17 October 2024 deadline. It classifies entities as 'essential' or 'important', mandates 24-hour early-warning, 72-hour incident notification, risk-management measures, management-body accountability, and fines up to €10 million / 2 % of global turnover.

EU Regulation 2022/2554 (DORA) became directly applicable across Malta's financial sector, imposing ICT risk-management, major-incident reporting, third-party risk oversight, and digital-resilience testing obligations. The Malta Financial Services Authority was designated as the national authority overseeing Threat-Led Penetration Testing.

Malta's second national cybersecurity strategy was unveiled at the Digital Malta Conference, built on four domains: governance, cyber resilience, cyber skills, and international cooperation. It set the current whole-of-society policy framework and aligned obligations with emerging EU instruments including NIS2 and the Cybersecurity Act.

MITA formally stood up the NCC-MT at the Cyber ROOT 2022 Conference in Valletta, fulfilling Malta's obligation under EU Regulation 2021/887. The NCC channels EU funding, coordinates research and industrial capacity-building, and connects Malta to the European Cybersecurity Competence Centre (ECCC) network.

The Information and Data Protection Commissioner imposed a €65,000 fine on IT company C-Planet after finding it had failed to implement adequate technical and organisational security measures, resulting in the 2020 exposure of 337,000 voters' records. This was one of the largest GDPR enforcement actions in Malta to that date.

A publicly accessible folder on C-Planet IT Solutions' server exposed the full Maltese electoral register, names, ID numbers, addresses, phone numbers, dates of birth, and political preferences for approximately 98 % of all voters. The breach was not notified to the IDPC by C-Planet, triggering the subsequent enforcement action.

Malta transposed EU Directive 2016/1148 through the Measures for High Common Level of Security of Network and Information Systems Order, assigning the Critical Information Infrastructure Protection (CIIP) Unit as national competent authority and establishing CSIRT-Malta. Operators of essential services and digital service providers became subject to mandatory security and incident-reporting obligations for the first time.

The GDPR began applying directly in Malta and was supplemented by Act XX of 2018 (Chapter 586), establishing the Information and Data Protection Commissioner (IDPC) as the independent supervisory authority. Controllers became subject to 72-hour breach notification to the IDPC and up to €20 million / 4 % of turnover fines for serious infringements, creating the first binding cybersecurity-adjacent breach reporting duty in Malta.

MITA published Malta's inaugural National Cyber Security Strategy, establishing governance structures, designating CSIRT-Malta, and setting goals across five pillars: governance, resilience, capability, awareness, and international co-operation. This document served as the foundational policy framework for over six years until the 2023-2026 strategy superseded it.

Malta incorporated computer-misuse offences into the Criminal Code, criminalising unauthorised access, data interference, and misuse of computer hardware, mirroring the Budapest Convention before its formal ratification. A dedicated Police Cybercrime Unit was subsequently established in 2003 to investigate offences where computers are the target or instrument of crime.