Data-centre rules
Data centre regulation in Malta
Our tracker lists 9 rules for building and running a data centre in Malta, national and EU, and 6 of them are in force.
Each comes with its status, who it applies to and the next date that matters. When a rule here changes, the change is logged below with its date.
Rules that apply in Malta
National rules first, then the EU rules every member state applies. Status as on the tracker.
| Rule | Level | Status | Applies to | Next date |
|---|---|---|---|---|
| Data Centres (Sustainability Reporting Obligations) Regulations, 2025 (S.L. 545.42, Legal Notice 271 of 2025), regulations 3 to 5 (public disclosure and European database reporting) | National | In force (Legal Notice 271 of 2025, published in the Government Gazette of Malta 21,545 on 28 November 2025; the regulations set no separate commencement date) | New and existing sites. Owners and operators of data centres in Malta with installed IT power demand of at least 500 kW (co-hosting, colocation and enterprise data centres) make the First Schedule information public and report to the European database; operators arrange to get data from colocation and co-hosting customers; defence and civil protection data centres excluded; the Regulator can impose an administrative penalty of up to 5,000 euros per breach and an offence carries a fine of up to 10,000 euros (regulations 8 and 10) | 15 May 2027 (annual deadline 15 May) |
| Same Regulations, regulation 6 (waste heat use and cost-benefit analysis) | National | In force (Legal Notice 271 of 2025, published 28 November 2025); the use duty applies following 11 October 2025 | New and existing sites for the use duty, new and substantially refurbished sites for the analysis. Data centre operators with a total rated energy input above 1 MW must use waste heat or other waste heat recovery applications unless they show it is not technically or economically feasible; the cost-benefit analysis is carried out whenever such a data centre is newly planned or substantially refurbished and its results go to the Regulator for Energy and Water Services within six months; data centres whose waste heat is used in a district heating network or on site are exempt | No date published |
| Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41, Legal Notice 71 of 2025), articles 3 and 4 and First Schedule sector 8 (digital infrastructure: data centre service providers), as amended by Legal Notice 89 of 2026 | National | In force since 23 January 2026 (commencement notice Legal Notice 22 of 2026; Order published in the Government Gazette on 8 April 2025) | New and existing sites. Providers of data centre services that are medium-sized enterprises or larger (in-house corporate data centres run by an entity for its own purpose are outside the definition); those above the medium-size ceilings are essential entities and the others in scope are important entities | No date published |
| EED reporting, Article 12 and Delegated Regulation 2024/1364 | EU | In force | New and existing sites. Data centres ≥500 kW installed IT power | 15 May 2027, next annual report |
| EED waste heat, Article 26(6) | EU | In force | New and existing sites. Data centres >1 MW total rated energy input | Ongoing duty |
| EED energy management systems, Article 11 | EU | In force as a Directive duty on Member States; deadline not yet reached | Enterprises, including data-centre operators, with average annual energy consumption above 85 TJ (23.6 GWh) over the previous three years, all energy carriers together | 11 October 2027, certified energy management system in place |
| EU rating scheme, delegated regulation adopted 21 Sep 2026 | EU | Adopted, in Parliament and Council scrutiny | New and existing sites. Same ≥500 kW reporting population | In force 20 days after Official Journal publication, if not objected to |
| EU minimum performance standards | EU | Consultation open | Not yet defined | 14 December 2026, consultation closes |
| Cloud and AI Development Act, COM(2026) 502 | EU | Proposal, with Parliament and Council | Cloud and AI infrastructure providers broadly | No fixed date |
Malta in detail
What the national rules say, with the legal texts.
Malta put the Directive's data centre articles into the Data Centres (Sustainability Reporting Obligations) Regulations, published on 28 November 2025. They cover data centres with installed IT power demand of at least 500 kW. Owners and operators publish their data and report to the European database by 15 May each year. Above 1 MW of total rated energy input, operators must use their waste heat unless that is not technically or economically feasible. A cost-benefit analysis is due whenever such a site is newly planned or substantially refurbished. The Regulator for Energy and Water Services can impose penalties of up to 5,000 euros per breach. Data centre service providers are also in scope of the NIS2 order, in force since 23 January 2026.
Dates to watch
The next dates for Malta and the EU, soonest first.
- 14 Dec 2026The EU Commission's minimum performance standards consultation and call for evidence closes
- 15 May 2027EU database due every year
- 11 Oct 2027EU deadline under Article 11 of the Energy Efficiency Directive for a certified energy management system at enterprises above 85 TJ (23.6 GWh) of annual energy consumption
What changed
Every change to these rules on the tracker, newest first.
- 18 Oct 2026Added to the tracker: EED energy management systems, Article 11 (In force as a Directive duty on Member States; deadline not yet reached).
- 16 Oct 2026Added to the tracker: Data Centres (Sustainability Reporting Obligations) Regulations, 2025 (S.L. 545.42, Legal Notice 271 of 2025), regulations 3 to 5 (public disclosure and European database reporting) (In force (Legal Notice 271 of 2025, published in the Government Gazette of Malta 21,545 on 28 November 2025; the regulations set no separate commencement date)).
- 16 Oct 2026Added to the tracker: Same Regulations, regulation 6 (waste heat use and cost-benefit analysis) (In force (Legal Notice 271 of 2025, published 28 November 2025); the use duty applies following 11 October 2025).
- 16 Oct 2026Added to the tracker: Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41, Legal Notice 71 of 2025), articles 3 and 4 and First Schedule sector 8 (digital infrastructure: data centre service providers), as amended by Legal Notice 89 of 2026 (In force since 23 January 2026 (commencement notice Legal Notice 22 of 2026; Order published in the Government Gazette on 8 April 2025)).
Get an alert for Malta
We write to this list when a rule here changes status or a date moves, usually within a week of the change appearing in the log above. Nothing else, and your address is never shared.
Questions
Which rules apply to a data centre in Malta?
Our tracker lists 9 rules for building and running a data centre in Malta, national and EU, and 6 of them are in force.
What is the next date for data centre rules in Malta?
The next date is 14 Dec 2026: the EU Commission's minimum performance standards consultation and call for evidence closes.
From the European data-centre regulation tracker, which cites the legal text for every rule.
Sources: EUR-Lex (Official Journal of the EU), European Commission, Legislation Malta.