Can I ask a company to give me all the personal data it holds about me in Malta?
Yes — this is the "right of access" and it is one of the core GDPR rights. Under Article 15 of the GDPR and the Data Protection Act (Cap. 586), you can ask any organisation (a company, hospital, bank or school) for a copy of all the personal data it holds about you, along with why it is kept, who it is shared with, and how long it will be stored. The controller must reply within one month, and the first copy is free of charge. The myth: that you must pay a fee or hire a lawyer. That idea comes from the old pre-GDPR law, when a small fee could be charged; today the request is free, can be made by a simple email, and if they ignore you, you can file a complaint with the IDPC. A fee can be charged only if the request is manifestly unfounded or excessive.
📋 The rules
- The right of access (Art. 15 GDPR) covers any personal data an organisation holds about you, not just documents you have sent.
- The controller must reply within one month of receiving the request; it can extend by two further months only if the request is complex.
- The first copy of the data is free; a reasonable fee may be charged for additional copies.
- The request can be made informally — in writing or by email — with no official form or lawyer needed.
- If they ignore you or reply poorly, you can lodge a complaint with the IDPC, the national data protection authority.
🔓 Exceptions
- The controller may charge a reasonable fee or refuse if the request is manifestly unfounded or excessive, for example repeated without reason.
- The right cannot reveal someone else's personal data; in that case the information may be edited or hidden.
- Certain areas — such as ongoing criminal investigations or professional secrecy — have limited exemptions under Cap. 586.
⚠️ Penalties & fines
If an organisation ignores a valid access request or replies inadequately, you can lodge a complaint with the IDPC, which has the power to investigate and impose sanctions. Under the GDPR, administrative fines can reach up to €20 million or 4% of annual worldwide turnover, whichever is higher — although in Maltese practice the IDPC often issues warnings or much smaller fines proportionate to the case. Beyond the fine, there is reputational damage and the legal cost of defending a complaint. For the individual, delay can mean you are unable to uncover misuse, correct errors, or gather evidence for another case (for example an employment dispute). The right of access is often the first step towards exercising other rights such as erasure or rectification of the data.
📎 Official sources
- IDPC · your rights under data protection →
- Legislation Malta · Data Protection Act (Cap. 586) →
- IDPC · home page and complaints form →
❓ Frequently asked
How long do they have to reply?
The controller must reply within one month of receiving your request. This period can be extended by two further months only when the request is particularly complex, and in that case they must inform you in advance of the reason for the delay.
Do you have to pay to request your data?
No, the first copy of your personal data is free under the GDPR. A reasonable fee may be charged only for additional copies or when the request is manifestly unfounded or excessive, and not as a normal rule for every request.
Do you need a lawyer or a special form?
No, you can make the request yourself by a simple email or letter to the organisation or its Data Protection Officer. There is no need for an official form or a lawyer, though it helps to state clearly which data you are looking for.
What can I do if they ignore me?
If the organisation does not reply within one month or refuses without a valid reason, you can lodge a complaint with the IDPC through their online form. The IDPC can investigate and, if it finds a breach, impose sanctions on the data controller.
Will I also see other people's data in my file?
No, the right of access covers only your own data, and other people's personal data may be edited or hidden before they give you the copy. Likewise, certain limited exemptions apply, for example to ongoing criminal investigations.
🔎 Common searches
What people search to land here:
- “data access request malta”
- “gdpr access request malta”
- “idpc data rights malta”
- “how to request my data malta”
- “data protection act 586 malta”
- “idpc complaint malta”