When a data subject asks a data controller for a copy of their personal data, the controller generally has to provide it.
What if, however, some of that data would reveal how the organisation intends to defend a claim brought against it by the data subject? If withholding that portion is necessary and proportionate to protect its ability to defend the claim, the controller may restrict access to that data while providing the rest, thereby restricting, to a certain extent, the rights of the data subject.
Malta’s Legal Notice 306 of 2026 (the “Notice”) published on on 3 November 2026, aims to clarify when such restrictions are permitted and what controllers must do when they apply them.
The Notice introduces amendments to the Restriction of the Data Protection (Obligations and Rights) Regulations (S.L. 586.09) (the “Regulations”), aiming to clarify the requirements for applying such restrictions, and further specifying what information controllers must provide to data subjects. The Notice further introduces requirements governing how restrictions are assessed and reviewed.
The Notice amends regulation 4(e), which deals with restrictions relating to legal claims and proceedings.
Previously, it was contemplated that controllers could restrict data subject rights where necessary for the establishment, exercise or defence of a legal claim, or in connection with legal proceedings that may be instituted under any law. The amendment now distinguishes two separate grounds:
First, controllers may protect communications or records covered by legal professional privilege and documents privileged under the Criminal Code, the Code of Organisation and Civil Procedure or equivalent legislation, subject to any applicable exemption. Privilege can protect certain confidential communications between an advocate and a client. In the data subject’s access request, it is clarified that the controller might withhold the personal data in a privileged email while disclosing the rest of the data covered by the request.
Second, controllers may restrict rights to establish, exercise or defend a legal right or claim, or in connection with legal proceedings in which the individual is or may be a party before a court, tribunal or other body exercising judicial or quasi-judicial powers. Where a controller relies on an anticipated claim or proceedings, it must demonstrate, through factual, specific and non-hypothetical circumstances, that these may potentially arise.
This latter ground can cover anticipated claims or proceedings, however, the controller must be able to point to specific facts showing how a claim or proceedings could arise. A general concern that disclosure might prompt a lawsuit remains insufficient.
Controllers already had to inform individuals when they restricted a right, unless doing so would prejudice the purpose of the restriction. The amended regulation 6 now specifies what the controller must say when it restricts a right in whole or in part. The reply must identify the legal ground for the restriction and the categories of personal data affected. Further, the controller must also tell the data subject that they can lodge a complaint with the Information and Data Protection Commissioner under the GDPR and seek a judicial remedy against the controller under Malta’s Data Protection Act.
If disclosure would prejudice the purpose of the restriction, the controller may omit the legal ground and the categories of data, albeit the reply must still explain both aforementioned routes for redress.
The application of any restriction already had to be necessary and proportionate. The amended regulation 7 now expressly requires controllers to assess and demonstrate both before applying a restriction and to review that assessment periodically.
In practice, this means assessing whether a narrower restriction would achieve the same objective. Once the justification falls away, the controller must lift the restriction without undue delay, inform the individual and accordingly comply with the relevant GDPR rights and obligations.
The amended regulation also requires controllers to maintain an updated register of restrictions applied in response to data subject requests. Such register must contain only strictly necessary information, including details identifying the data subject, the right requested, the date the request was received, the legal basis for the restriction and, where applicable, the date of the last review.
Controllers should check their existing procedures against the amended regulations.
In practice, that means updating response templates so they explain both routes for redress even where the legal ground and data categories are withheld, checking that the register captures the prescribed details, and assigning responsibility for periodic reviews. Where a restriction protects a legal defence, the review should ask whether developments in the dispute still justify withholding the same data.
The difficult question remains how much personal data can be disclosed while still protecting a legal defence.
For more information or assistance on data protection laws kindly contact us at info@gtg.com.mt.
Authors: Dr J.J. Galea and Dr Mattea Pullicino