For organisations in Malta, 2026 has been a year of guidance and preparation rather than new legislation. The Information and Data Protection Commissioner (IDPC) has reported on its work, and several European developments will shape how GDPR enforcement works from 2027.
1. The IDPC's 2025 Annual Report
On 19 August 2026 the IDPC published its 2025 Annual Report and Financial Statements, which Commissioner Reno Borg later discussed in a television interview. The IDPC also publishes a regular newsletter on data protection and AI. Commentators describe a gradual shift from a mainly advisory approach towards more assertive enforcement.
As a reminder, the IDPC can impose GDPR fines of up to EUR 20 million or 4% of worldwide annual turnover; for public authorities, Maltese law sets lower limits.
2. EDPB Guidelines on Fines and Corrective Measures
On 21 September 2026 the European Data Protection Board (EDPB) adopted guidelines on when supervisory authorities should impose fines compared with their other corrective powers. They describe a step-by-step method — covering the legal basis for a fine, the liability and culpability of the controller or processor, aggravating and mitigating factors, and whether a fine is effective, proportionate and dissuasive — with 14 practical examples. The guidelines are open for public consultation until 13 November 2026. At the same meeting, the EDPB adopted final guidelines on the interplay between the Digital Services Act and the GDPR, relevant for online platforms.
3. Smart Glasses
In October 2026 the EDPB adopted a statement on smart glasses and published a report on video recording and surveillance in this context. Organisations considering such devices for staff should assess them carefully — including the rights of people being recorded.
4. EU Developments to Watch
- GDPR Procedural Regulation (EU) 2025/2518 applies from 2 April 2027 and harmonises cross-border complaints and investigations
- Coordinated enforcement 2026: European authorities are checking transparency and information obligations (Articles 12–14 GDPR)
- Digital Omnibus: the proposed GDPR changes have stalled in the Council; the current rules still apply
Your Checklist
- Review your privacy notices for completeness and accessibility
- Check your accountability documentation: records of processing, DPIAs and processor agreements under Article 28 GDPR
- Assess new technologies such as smart glasses before deployment
- Prepare a process for responding to IDPC requests
How ResGuard Can Help
The ResGuard Data Protection Manager keeps your GDPR documentation in one place, and our outsourced DPO service for Malta supports you in dealing with the IDPC.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: IDPC website and publications, EDPB press releases and Regulation (EU) 2025/2518.