Short answer: yes. Sending marketing emails from Malta, or to people in Malta, is perfectly legal, provided you follow two layers of rules. The first is the EU General Data Protection Regulation (GDPR), which governs how you collect and store personal data, supplemented locally by the Data Protection Act (Chapter 586 of the Laws of Malta). The second is the Processing of Personal Data (Electronic Communications Sector) Regulations, Subsidiary Legislation 586.01, which is Malta’s transposition of the EU ePrivacy Directive and contains the specific rules on marketing emails and texts.
This page is general information, not legal advice. For a campaign with real legal exposure, speak to a Maltese data protection lawyer.
The core rule: prior consent in writing
Regulation 9(1) of S.L. 586.01 says you may not send an unsolicited direct marketing communication by electronic mail unless the recipient has given prior consent in writing. Two details make Malta stricter than many people expect:
- It covers companies as well as individuals. The regulation applies “irrespective of whether such subscriber or user is a natural person or legal person”. In practice, a cold B2B email to a Sliema fund administrator or a Valletta law firm needs the same consent as one sent to a private individual.
- “Electronic mail” includes SMS. The regulations define electronic mail as any text, voice, sound or image message sent over a public communications network and stored until collected. Marketing texts to +356 mobile numbers therefore fall under the same consent rule as email.
In a digital workflow, “in writing” is usually satisfied by a clear opt-in on a web form with a timestamped record, which is why a double opt-in confirmation is a sensible default for Maltese lists.
The soft opt-in for existing customers
Regulation 9(2) provides an exception. If you obtained a customer’s email address in the context of a sale of a product or service, you may market your own similar products or services to them without fresh consent, as long as they were given a free and simple way to object when you collected the address, and are given it again in every message. A Gozo farmhouse operator can therefore email past guests about next season’s availability, but cannot share those addresses with a partner restaurant or promote unrelated products.
What every marketing email must contain
Regulation 9(4) prohibits marketing emails that disguise or conceal the sender’s identity or that lack a valid address to which the recipient can send a request to stop. Add GDPR transparency on top and each campaign should carry:
- A recognisable sender name and a reply address you actually monitor.
- A working unsubscribe link, honoured promptly.
- A link to your privacy notice explaining the legal basis for processing.
Penalties and who enforces them
The Information and Data Protection Commissioner (IDPC) enforces both regimes. The penalty levels differ:
| Breach | Maximum administrative fine |
|---|---|
| ePrivacy marketing rules (S.L. 586.01, regulation 13) | €23,293.73 per violation, plus €2,329.37 for each day the violation persists |
| GDPR, most serious infringements (Article 83(5)) | €20 million or 4% of worldwide annual turnover, whichever is higher |
| GDPR, public authorities and bodies (Data Protection Act, Cap. 586, article 21) | €25,000 per violation, or €50,000 for Article 83(5)/(6) infringements, plus daily fines |
Decisions of the Commissioner under S.L. 586.01 can be appealed to the Data Protection Appeals Tribunal, and anyone who suffers loss because of a breach can also seek compensation before the courts.
Sector rules that sit on top
Malta’s key industries bring extra obligations. Online gaming operators licensed by the Malta Gaming Authority must also follow its rules on commercial communications, and financial services firms supervised by the Malta Financial Services Authority face conduct rules on how products are promoted. Your email programme has to satisfy the data protection law and your sector regulator at the same time.
Sending to people outside Malta
If your list includes subscribers elsewhere in the EU, GDPR applies to them too, and the national ePrivacy law of their country may add its own rules. Mailing Swiss contacts brings in Swiss emailing law; mailing Canadians brings in CASL. For a broader overview of the EU framework, see Mailpro’s GDPR compliance page.
Where your data lives
Using an email service provider is itself a processing arrangement under GDPR, so you need a data processing agreement and a lawful basis for any transfer outside the EU. Mailpro stores data in Switzerland, which benefits from an EU adequacy decision, so no additional transfer mechanism such as standard contractual clauses is needed for that hosting. The infrastructure is private and outside US jurisdiction, and subscriber data is never sold or rented. Read more on why Swiss hosting matters, then continue with our guide to collecting permission in Malta.