Malta Recording Laws: Consent Rules and Penalties (2026)

Malta has no statute requiring every party to a conversation to consent before it can be recorded. The law widely cited as Malta's recording rule, Chapter 399, is a telecoms licensing act with no recording provision at all; the real confidentiality rule, S.L. 586.01, binds only third parties, not the people on the call.

Correcting a Common Claim: Chapter 399 Is Not Malta's Recording Law

Many summaries of Malta's recording rules point to Chapter 399 of the Laws of Malta and describe an all-party consent requirement. Read directly, Chapter 399 is the Electronic Communications (Regulation) Act, a statute that regulates Malta's electronic communications market: licensing by the Malta Communications Authority, spectrum allocation, interconnection, and numbering. Its stated purpose is to regulate electronic communications, not personal privacy.

The only privacy-adjacent content in Chapter 399 is an enabling clause, art. 44(1)(k) and (r), letting the Minister make regulations on confidentiality of communications and on telecom operators' legal-interception obligations. Chapter 399 does not itself state any rule about whether a person can record their own conversation. The actual rule lives in the regulations made under that clause.

The Actual Rule: S.L. 586.01 and the Confidentiality of Communications

Those regulations, the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01), implement the EU's ePrivacy Directive 2002/58/EC, as amended by Directive 2009/136/EC, into Maltese law, the same directive family that shapes recording rules across the bloc (see the EU recording laws overview for how other member states implement it). Regulation 4(1) is Malta's substantive confidentiality-of-communications rule, and its wording draws a boundary most secondary sources miss: "no person other than the user, shall listen, tap, store or undertake any other form of interception or surveillance of communications and of any related traffic data, without the consent of the user concerned."

That duty runs against a third party eavesdropping on someone else's communication. It does not restrict a participant from recording a conversation they are part of. Nothing in reg. 4(1), or anywhere else in S.L. 586.01, requires every party on a call to agree before one of them can record it.

Regulation 4(2) goes further and expressly carves out ordinary business recording: it states the restriction does not affect any legally authorised recording of communications in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other business communication. A company recording customer service calls to document a transaction sits outside reg. 4(1) entirely on this basis, though the recording still counts as personal-data processing under the separate Data Protection Act.

Data Protection Act: When Recording Needs a Lawful Basis

Outside the criminal law, Malta treats a recording that captures an identifiable person as personal-data processing under the Data Protection Act, Cap. 586, which implements the GDPR domestically. Recording that stays purely personal or household, such as keeping a private phone call for your own records, is exempt under art. 4(1)(c), which mirrors the GDPR's household exemption almost word for word: the Act does not apply to processing of personal data by a natural person in the course of a purely personal or household activity.

That exemption has limits. Recording that leaves the purely personal sphere, for example footage posted online, used in a dispute, or capturing space beyond the recorder's own property, needs a lawful basis under the GDPR rather than relying on the household exemption. Cap. 586 backs the Information and Data Protection Commissioner (IDPC) with real enforcement power: administrative fines against a public authority are capped at EUR 25,000 (plus EUR 25 per day) for lesser infringements and EUR 50,000 (plus EUR 50 per day) for more serious ones under art. 21, while a private-sector controller faces the uncapped GDPR fine regime directly. Separately, knowingly giving the Commissioner false information or refusing a lawful investigative request is itself an offence under art. 22, punishable by a fine of EUR 1,250-50,000, up to 6 months' imprisonment, or both.

CCTV and the IDPC's Apartment-Block Decision

The IDPC's own enforcement record shows how the household-exemption line gets drawn in practice. In decision CDP/COMP/426/2022, decided 6 January 2023, the Commissioner examined CCTV cameras an apartment owner installed to cover the building's common entrance, facade, pavement, shared stairwell, and rooftop. Because the cameras reached shared and public-facing areas rather than only the owner's own private space, the Commissioner held that the systematic recording of public spaces, public access areas and common parts by a CCTV camera cannot be considered processing of personal data by a natural person during a purely personal or household activity.

With the household exemption unavailable, the cameras had to justify themselves under the GDPR's ordinary legitimate-interest test, art. 6(1)(f), and failed it: the Commissioner found no concrete evidence of a present, real security threat to support the intrusion. The order required removal of three of the five cameras and restriction of a fourth to the owner's own balcony within 20 days, backed by the threat of an administrative fine under GDPR art. 83(6).

IDPC's published CCTV guidance for individuals extends the same reasoning to any home camera: the household exemption is lost the moment a camera captures any public space, even partially; footage should generally not be kept beyond a few days; visible signage is required; and audio recording through a CCTV system is rarely justifiable because it is far more intrusive than video alone.

Criminal Code: When Recording Becomes a Crime

Malta's Criminal Code, Cap. 9, has no dedicated title on eavesdropping or violation of correspondence, and no general wiretap offence. Three narrower provisions can still reach certain kinds of recording.

Article 208E criminalizes taking or disclosing a private sexual photograph or film without the depicted person's consent, when done with intent to cause distress, emotional harm, or harm of any nature. Conviction carries up to 5 years' imprisonment, a fine (multa) of EUR 4,000-8,000, or both, and the punishment rises by one degree when the offence is used as a means of blackmail.

The Computer Misuse sub-title, art. 337C(1)(k), makes it an offence to intercept, without authorisation and by technical means, non-public transmissions of data to, from, or within an information or computer system. Malta's harassment and stalking provisions, art. 251A(3)(g), separately list watching or spying on a person among the acts that can constitute stalking when repeated in a way that causes fear.

None of these three provisions turns on how many parties consented to a recording. They target specific harms, namely non-consensual intimate images, unauthorised technical interception, and a pattern of surveillance amounting to stalking, rather than setting a general consent rule for conversations. Nearby Mediterranean jurisdictions frame the underlying question differently; see how Cyprus and Italy approach recording consent, or return to the world recording laws hub for the full country index.

Penalties

What This Article Could Not Establish, and Where Care Is Needed

Research for this article could not establish Malta's position on two questions readers commonly ask. No source could be reached on filming police officers or enforcement officials in public, and no primary Transport Malta or civil aviation guidance on drone privacy restrictions could be retrieved. No Maltese enforcement incidents involving people filming officials were identified either way.

No Maltese court judgment on the admissibility of a covertly recorded conversation was located in civil, employment or criminal proceedings, and no published guidance specifically addressing workplace call recording was found.

Where no authority could be located, that is a statement about what is findable in public sources, not a conclusion that the conduct is permitted or prohibited. Anyone facing a specific situation should take advice from a lawyer licensed in the jurisdiction.

This article provides general legal information about Malta, not legal advice. Laws change and their application depends on specific facts. Information verified as of July 27, 2026. Consult a lawyer licensed in Malta for advice about a specific situation.

Frequently Asked Questions

Is Malta an all-party consent country for recording conversations?

No. No Maltese statute requires the consent of every party before a conversation can be recorded. The confidentiality rule in S.L. 586.01 reg. 4(1) applies only to a person other than the user of the communication, not to a participant recording their own call.

Can I legally record a phone call I am part of in Malta?

There is no criminal or regulatory rule against a participant recording their own conversation. Once you keep or use the recording, however, it can count as personal-data processing under the Data Protection Act if it goes beyond purely personal or household use.

Does Chapter 399 of the Laws of Malta require consent to record?

No. Chapter 399 is the Electronic Communications (Regulation) Act, a telecoms market licensing statute. Its full text has no recording-consent provision; it only lets the Minister make separate regulations, which is where S.L. 586.01 comes from.

Can a business record customer service calls in Malta?

Yes. S.L. 586.01 reg. 4(2) states the confidentiality restriction does not affect legally authorised recording of communications in the course of lawful business practice to provide evidence of a commercial transaction or other business communication.

Is secretly recording someone a crime in Malta?

There is no general wiretap or eavesdropping offence in the Criminal Code. Narrower provisions can still apply depending on the facts: art. 208E for non-consensual intimate images, art. 337C(1)(k) for unauthorised technical interception of computer data, and art. 251A(3)(g) where repeated watching or spying amounts to stalking.

Can I install CCTV that covers shared or public areas in Malta?

It is risky without a clear justification. In decision CDP/COMP/426/2022, the IDPC found that CCTV covering an apartment building's common entrance, facade, and stairwell fell outside the household exemption and failed the GDPR's legitimate-interest test, and ordered the cameras removed or restricted.