Information and Data Protection Commissioner (IDPC)

What Information and Data Protection Commissioner (IDPC) does

The Information and Data Protection Commissioner (IDPC) is Malta's national supervisory authority responsible for monitoring the application of the General Data Protection Regulation, the Data Protection Act (Cap. 586 of the Laws of Malta), the Freedom of Information Act, and the Re-Use of Public Sector Information Act. IDPC has additionally been designated as the competent authority for the EU AI Act under Subsidiary Legislation 586.14, extending its mandate to artificial intelligence oversight. The office operates as an independent constitutional regulator headed by Commissioner Ian Deguara, with a team of approximately 22 staff based at its Sliema headquarters, and serves two principal segments: Maltese individuals exercising data protection and FOI rights, and organisations (controllers and processors) seeking GDPR compliance guidance.

IDPC's service surface is built on government regulatory digital infrastructure rather than commercial software products. Core offerings include an Online Self-Assessment Compliance Tool that lets organisations evaluate GDPR readiness, an Online Breach Notification System for controllers, an Online Complaint Filing System for data subjects, DPIA guidelines and templates, an IDPC newsletter, and EU-funded awareness resources such as the GDPRights project and the Children's Online Data Protection Campaign launched on Data Protection Day 2026. The office uses the EU's Internal Market Information (IMI) system for cross-border complaint exchange and participates in international forums including the European Data Protection Board, Global Privacy Assembly (member since 2003), GPEN (since 2015), the Berlin Group, BIIDPA, and the Common Thread Network.

IDPC generates no commercial revenue. Its services are provided free of charge to data subjects and organisations as a public regulatory function, funded through Maltese public budgetary allocation. The office is constitutionally independent, exercises statutory enforcement powers including the issuance of legally binding decisions, and operates exclusively within Malta's domestic jurisdiction while participating in EU and international data protection cooperation frameworks. IDPC is not privately owned, venture-backed, or commercially traded.

Name

Information and Data Protection Commissioner (IDPC)

Legal name

Information and Data Protection Commissioner

Website

https://idpc.org.mt

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

The Information and Data Protection Commissioner (IDPC) is Malta's independent national supervisory authority overseeing GDPR, the Data Protection Act, the Freedom of Information Act, and the EU AI Act. It serves Maltese citizens exercising data rights and organisations seeking compliance guidance through free regulatory services, digital tools, and enforcement actions.

Ownership category

akta.pro rank

Product category

Privacy and Data Protection Regulatory Services

NAICS

Public Administration (92), Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (92615)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

akta.pro secondary industry

Privacy Management (Consent, DSAR, RoPA) (HDADAFAH)

Keywords

• Data protection regulation
• GDPR compliance oversight
• Privacy rights enforcement
• Regulatory supervisory authority
• Freedom of information oversight

Headquarters

HQ city

Sliema

HQ country

Malta

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Others

Distribution channels2 records

Marketing channels5 records

Core offering

IDPC is Malta's independent national supervisory authority for data protection, providing regulatory oversight and enforcement of the GDPR, Data Protection Act (Cap. 586), Freedom of Information Act, Re-Use of Public Sector Information Act, and the AI Act. It offers online complaint filing and breach notification portals, an Online Self-Assessment Compliance Tool for organisations, DPIA guidelines and templates, public awareness campaigns, and newsletter dissemination, all delivered free of charge as public regulatory services.

Product overview

The Information and Data Protection Commissioner (IDPC) operates as Malta's national supervisory authority for data protection, providing regulatory oversight, guidance, and compliance tools rather than a commercial software product. The IDPC's offerings consist of regulatory services and digital tools including an Online Self-Assessment Compliance Tool for businesses to evaluate GDPR compliance, online submission systems for breach notifications and data protection complaints, a newsletter subscription service, and various educational resources including GDPR awareness campaigns and DPIA guidelines. These services are designed to support both data subjects exercising their rights and controllers meeting their obligations under the GDPR and national data protection legislation.

Differentiator

Problem solved

Functional benefit

Products and services

• Online Self-Assessment Compliance Tool A web-based self-assessment tool that enables businesses to evaluate their compliance with the GDPR, identify risks of non-compliance, and receive guidance on corrective measures.
• Data Protection Complaint Filing System An online form enabling data subjects to lodge complaints with the Commissioner when they believe their data protection rights have been infringed.
• Online Breach Notification System A dedicated online form for data controllers to notify the Commissioner of personal data breaches in accordance with GDPR breach notification requirements.
• Data Protection Impact Assessment (DPIA) Guidelines and Templates Official guidelines and downloadable templates developed by IDPC to help controllers conduct data protection impact assessments in accordance with Article 35 GDPR.
• IDPC Awareness Campaign Materials Educational materials including videos and publications designed to raise public awareness on data protection rights under the GDPR, co-financed by the European Rights, Equality and Citizenship Programme.
• Children's Online Data Protection Campaign A public awareness campaign launched on Data Protection Day 2026 focused on children's online safety and data protection, providing resources and guidance on protecting children's personal data online.

Segments2 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Six partnerships are on record, tiered core.

• Information Commissioner of the Isle of MancoreStrategic or Co-development Partner · 18 September 2025Signed at the 2025 Global Privacy Assembly in Seoul, this MoU strengthens existing relations and promotes exchanges to assist each other in delivering their regulatory functions. The agreement establishes a framework for cooperation supporting data-driven economies while protecting fundamental rights of citizens in Malta and the Isle of Man, along with mechanisms for regular communication, knowledge sharing, and consultation on issues of mutual implication, including enforcement cooperation.
• National Privacy Commission of the PhilippinescoreStrategic or Co-development Partner · 18 October 2023Signed at the 45th Global Privacy Assembly in Bermuda, this MoU commits both authorities to foster collaboration in the area of personal data protection. Both parties acknowledge the importance of keeping each other informed about their respective regulatory activity to better protect the rights of citizens of the Philippines and Malta, and to support businesses in compliance with data protection laws.
• UK Information Commissioner's Office (ICO)coreStrategic or Co-development Partner · 21 June 2023Signed during the annual BIIDPA meeting in Malta, this MoU establishes a structured framework for systematic exchange of best practices, regulatory intelligence, technical expertise, and operational insights. The agreement is designed to enhance supervisory effectiveness, promote regulatory consistency, and support robust application and enforcement of data protection and privacy legislation within both jurisdictions.
• Gibraltar Regulatory AuthoritycoreStrategic or Co-development Partner · 25 October 2022Signed at the 44th Global Privacy Assembly in Istanbul, this MoU enhances bilateral cooperation between IDPC and GRA. Both authorities are members of the BIIDPA network and enjoy a longstanding relationship. The memorandum introduces collaboration mechanisms including exchange of best practices and mutual assistance to streamline their respective regulatory duties.
• Information and Data Protection Commissioner of AlbaniacoreStrategic or Co-development Partner · 12 September 2022Signed at the margins of the 69th EDPB Plenary in Brussels, this cooperation agreement aims to deepen mutual exchange of best practices, information, and expertise to facilitate the application and enforcement of data protection law in both jurisdictions. The parties intend to commence cooperation activities immediately.
• National Centre for Personal Data Protection of the Republic of MoldovacoreStrategic or Co-development Partner · 18 November 2021This cooperation agreement fosters closer collaboration for the exchange of information on enforcement activities, mutual professional development and training, organisation of study visits and workshops between IDPC and the Moldovan national data protection authority.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Market position

Weaknesses4 records

Competitive moat3 records

Key risks4 records

Key highlights6 records

Customer concentration

• Xx.com/IDPC_Malta
• LinkedInlinkedin.com/company/idpcmalta

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Information and Data Protection Commissioner (IDPC)