S.L. 460.41 Art. 3Applicability. 

(1) This order applies to public or private entities of a type listed in the First or Second Schedule which qualify as medium-

sized enterprises under Article 2 of the Annex of Commission Recommendation 2003/361/EC or exceed the ceilings for medium-sized enterprises provided for in that article, and which provide their services or carry out their activities within the Union.

(2) Article 3(4) of the Annex to Commission Recommendation 2003/361/EC shall not apply for the purposes of this order.

(3) Regardless of their size, this order also applies to entities of a type listed in the First or Second Schedule, where:

(a) services are provided by:

(i) providers of public electronic communications networks or of publicly available electronic communications services;

(ii) trust service providers;

(iii) top-level domain name registries and domain name system service providers;

(b) the entity is the sole provider in Malta of a service which is essential for the maintenance of critical societal or economic activities;

(c) disruption of the service provided by the entity may have a significant impact on public safety, public security or public health;

(d) disruption of the service provided by the entity may induce a significant systemic risk, in particular for sectors where such disruption may have a cross-border impact;

(e) the entity is critical because of its specific importance at national level for the particular sector or type of service, or for other interdependent sectors in Malta;

(f) the entity is a public administration entity:

(i) if it is a government entity established in accordance with national law; or

(ii) if it is a local government authority established in accordance with national law and which following a risk assessment, provides services the disruption of which may have a significant impact on critical or societal or economic activities.

(4) Regardless of their size, this order applies to entities identified as critical entities in accordance with Directive (EU) 2022/ 2557;

(5) Regardless of their size, this order also applies to entities providing domain name registration services.

(6) This order is without prejudice to Malta’s responsibility for safeguarding its national security and its power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.

(7) This order shall not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences.

(8) Entities which carry out activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences, or which provide services exclusively to the public administration entities referred to in sub-article (7) are exempt from the obligations laid down in articles 19 or 20 with regard to those activities or services. The supervisory and enforcement measures in Part VII shall not apply in relation to those specific activities or services:

Provided that where the entities carry out activities or provide services exclusively of the type in this sub-article, those entities shall also be exempt from the obligations established in article 24.

(9) Sub-articles (7) and (8) shall not apply where an entity acts as a trust service provider.

(10) This order shall not apply to entities which are exempted from the scope of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/ 2014, (EU) No 909/2014 and (EU) 2016/1011, in accordance with CYBERSECURITY ACROSS THE EUROPEAN UNION 460.41 (MALTA)

Article 2(4) of the said Regulation.

(11) The obligations established in this order shall not entail the supply of information the disclosure of which would be contrary to the essential interests of the national security, public security or defence of Malta.

(12) This order applies without prejudice to the Data

Protection Act, the Processing of Personal Data (Electronic

Communications Sector) Regulations, the Criminal Code and Directive

(EU) 2022/2557;

(13) Without prejudice to Article 346 of the Treaty on the Functioning of the European Union, information that is confidential pursuant to Union or national rules, such as rules on business confidentiality, shall be exchanged with the European Commission and other relevant authorities in accordance with this order only where that exchange is necessary for the application of this order. The information exchanged shall be limited to that which is relevant and proportionate to the purpose of such exchange. The exchange of information shall preserve the confidentiality of such information and protect the security and commercial interests of entities concerned.

(14) Entities, the CIP Department or where designated the competent authority, the single point of contact and CSIRTs shall process personal data to the extent necessary for the purposes of this order and in accordance with the Data Protection Act, including the regulations made thereunder, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), in particular such processing shall rely on Article 6 of the said Regulation.

(15) The processing of personal data pursuant to this order by providers of public electronic communications networks or providers of publicly available electronic communications services shall be carried out in conformity with national data protection legislation,

Union data protection law and Union privacy law, in particular the

Processing of Personal Data (Electronic Communications Sector)

Regulations.

(16) Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify the CSIRT of significant incidents and where those requirements are at least equivalent in effect to the obligations established in this order, the relevant provisions of this order, including the provisions on supervision and enforcement established in Part VII, shall not apply to such entities:

Provided that where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this order, the relevant provisions of this order shall continue to apply to the entities not covered by those sector-specific Union legal acts.

(17) The requirements in sub-article (16) shall be considered to be equivalent in effect to the obligations established in this order where:

(a) the cybersecurity risk-management measures are at least equivalent in effect to those in articles 19(1), (2) and (3); or

(b) the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the incident notifications by the CSIRTs, the CIP Department or where designated the competent authorities or the single points of contact in accordance with this order and where requirements to notify significant incidents are at least equivalent in effect to those established in articles 20(1) to (6).