S.L. 460.41 Art. 23Jurisdiction and territoriality. 40 [S.L.

(1) Entities falling within the scope of this order shall be considered to fall under the jurisdiction of Malta if they are established in Malta, except in the case of:

(a) providers of public electronic communications networks or providers of publicly available electronic communications services, which shall be considered to fall under the jurisdiction of the Member State in which they provide their services;

(b) DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines or of social networking services platforms, which shall be considered to fall under the jurisdiction of the Member State in which they have their main establishment in the Union in accordance with sub-article (2);

(c) public administration entities, which shall be considered to fall under the jurisdiction of the Member State which established them.

(2) For the purposes of this order, an entity as provided for in in sub-article (1)(b), shall be considered to have its main establishment in the Union, in the Member State where the decisions related to the cybersecurity risk-management measures are predominantly taken: CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

Provided that, if such a Member State cannot be determined or if such decisions are not taken in the Union, the main establishment shall be considered to be in the Member State where cybersecurity operations are carried out.

Provided further that, if such a Member State cannot be determined, the main establishment shall be considered to be in the Member State where the entity concerned has the establishment with the highest number of employees in the Union.

(3) If an entity in sub-article (1)(b), is not established in the Union, but offers services within the Union, it shall designate a representative in the Union and such representative shall be established in one (1) of those Member States where the services are offered. Such an entity shall be considered to fall under the jurisdiction of the Member State where the representative is established.

(4) In the absence of a representative in the Union designated in accordance with sub-article (3), the CIP Department or, where designated, the competent authority, may take legal action against the entity for the infringement of this order where the entity provides services in Malta.

(5) The designation of a representative by an entity as provided for in sub-article (1)(b), shall be without prejudice to legal action which could be initiated against the entity itself.

(6) Upon a request for mutual assistance in relation to an entity in sub-article (1)(b), the CIP Department or, where designated, the competent authority may, within the limits of such request, take appropriate supervisory and enforcement measures in relation to the entity concerned that provides services or which has a network and information system in Malta.