In Malta, permission is not a formality you tick once. Regulation 9 of S.L. 586.01 requires prior consent in writing before you send marketing by email or SMS, whether the recipient is a consumer or a company. GDPR then adds its own definition of valid consent: freely given, specific, informed and unambiguous. This guide turns those requirements into a workflow. It is general information, not legal advice.
Step 1: Decide your legal route for each contact
Split your contacts into two groups before you send anything:
- Customers under the soft opt-in. People who gave you their address while buying a product or service, were offered a free way to refuse at that moment, and did not refuse. You may promote your own similar products to them. A Mellieħa dive centre can email past divers about new courses; it cannot use the list to sell a partner’s apartments.
- Everyone else. Newsletter sign-ups, event attendees, trade-fair contacts, prospects and business cards all need explicit written opt-in.
Step 2: Write consent wording people understand
Informed consent means the person knows who is contacting them, through which channel and about what. A good Maltese opt-in line names your brand, lists email and/or SMS separately and links to your privacy notice. Where your audience is mainly Maltese-speaking, provide the wording in Maltese as well as English; both are official languages and understanding is part of validity.
Avoid pre-ticked boxes and avoid bundling marketing consent with acceptance of your terms or a competition entry. Under GDPR, consent that is a condition of something else is unlikely to be freely given.
Step 3: Capture it “in writing”
Online, a clear form submission with a time, date and source is the practical form of written consent. The strongest option is double opt-in: the subscriber confirms by clicking a link in a first email, which both proves the address is theirs and creates a record. Mailpro’s subscription forms handle this automatically and store the confirmation with the contact. For the differences between the two approaches, see opt-in vs double opt-in.
Step 4: Handle SMS consent separately
Because the Maltese definition of electronic mail covers text messages, an email opt-in does not automatically cover SMS. Add a separate checkbox for texts and collect the mobile number in international format (+356 followed by eight digits). Mailpro’s guide to collecting SMS opt-ins covers the form set-up.
Step 5: Keep the proof
If a subscriber complains to the IDPC, you will need to show when and how consent was given. Keep at least:
- The form or page where the person signed up, and the wording shown at the time.
- Date, time and IP or source of the sign-up.
- The double opt-in confirmation event.
- Any later changes, such as withdrawing SMS consent but keeping email.
Step 6: Make withdrawal as easy as sign-up
Every message needs a visible way to opt out, and regulation 9(4) specifically requires a valid address to which people can send a stop request. Mailpro adds an unsubscribe link to every campaign and suppresses the contact automatically; you can also customise the unsubscribe link to match your brand voice.
Special cases in Malta
Seasonal guests and tourists
Many Maltese businesses collect contacts from visitors who live elsewhere in the EU or beyond. GDPR follows the data, so the same standard applies, and the visitor’s own country may add rules. A consistent double opt-in covers most situations.
Gaming and financial promotions
Licensed gaming operators and regulated financial firms should record consent per product category and respect self-exclusion or vulnerability flags from their compliance systems. Segment these contacts so they never receive promotions.
Re-permission campaigns
If you cannot show how an old list was gathered, send one plain re-permission email asking people to confirm, and remove anyone who does not. It shrinks the list but protects your sender reputation.
Once permission is in place, move on to planning email campaigns in Malta, and read the full overview of Maltese email marketing law.