S.L. 188.6 Art. 26 Data Protection.. Cap. 586.

(1) Nothing in these regulations shall prejudice the applicability of the Regulation and the Data Protection Act and the fundamental rights and freedoms of the data subject.

(2) Where the Agency in its capacity of data controller processes personal data on the applicant or the beneficiary and, or dependants, as established under these regulations, it shall:

(a) comply with the principles relating to processing of personal data pursuant to Article 5(1) of the Regulation;

(b) apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed, and prevent abuse or unlawful access to or transfer of, personal data pertaining to the applicants.

(3) The controller shall retain the personal data of the beneficiary and/or his dependants as long as the certificate issued to the beneficiary and dependants, if any, pursuant to these regulations remains valid:

Provided that where the application is refused, or where the certificate is revoked, such data shall be retained for the purposes of these regulations for a period of five (5) years from the date of the refusal of the application or the revocation of the certificate thereof.

(4) Where the Agency pursuant to its functions under these regulations processes information in relation to the due diligence process, the Agency may restrict the rights and obligations provided for in Articles 14 to 20 and Article 34 of the Regulation in accordance with Article 23 of the Regulation:

Provided that such personal data shall only be restricted in case the Agency refuses the application or revokes the certificate:

Provided further that the Agency’s Data Protection Officer designated pursuant to Article 37 of the Regulation shall be consulted as appropriate in a timely manner in the entire process of applying the restriction.

(5) The restrictions under sub-regulation (4) shall only apply in the event that these restrictions are considered as a necessary and proportionate measure to protect the sources and confidentiality of legally privileged information collected in the course of carrying out the due diligence process and to:

§Vide regulation 25 of Legal Notice 159 of 2025. THE BASIS OF MERIT

(a) safeguard important objectives of general public interest of the Republic of Malta; or

(b) protect national and public security and the obligations of the Agency connected with its functions pursuant to these regulations.

(6) The Agency shall apply the restrictions referred to in sub-regulation (4) for as long as the reasons justifying them remain applicable following a necessity and proportionality test:

Provided that such reasons justifying the restrictions shall be documented and made available to the Commissioner when and as required.

(7) Where the reasons for a restriction no long apply, the Agency shall lift the restriction and inform the data subject concerned accordingly and comply with the rights and obligations provided for in Articles 14 to 20 and Article 34 of the Regulation.

(8) The Agency shall review the application for the restrictions referred to in this regulation every year and depending on the outcome of such review inform the data subject accordingly.

(9) For the safeguard of the rights and freedoms of the data subject, the following conditions and safeguards shall apply to documents, reports and other personal data processed throughout the due diligence process subject to the restrictions in terms of sub-regulation (4):

(a) access to due diligence data by competent authorities other than the Agency shall not be permitted unless provided for by law;

(b) the Agency shall maintain an audit trail record of access to due diligence data by competent authorities, containing at least the date of the access, the identifiable details of the Agency’s officer accessing the data, the requesting competent authority and the purpose for the access. Such audit trail record shall be kept for as long as the due diligence data is stored in line with regulation 20(3);

(c) the Agency’s Data Protection Officer shall keep a register to record the restrictions applied in relation to the requests made by the applicants. The register shall include the details of the applicants, the right requested to be exercised that was restricted and the purpose for such restriction. Restriction of rights in terms of Article 34 of the Regulation, shall also be recorded in the register; and

(d) the applicants in their capacity as data subjects shall be informed of the application of restrictions to their rights by informing the data subject concerned in reply to the request to exercise any of the rights which are being restricted in terms of these regulations, unless this may be prejudicial to the purpose of the restriction:

Provided that the Agency justifies the prejudice claimed by the Agency to the Commissioner when and where requested.

(10) In this regulation unless the context otherwise requires, Article 4 of the Regulation shall apply. mutatis mutandis *