S.L. 460.43 Art. 22Breach of personal data.   Cap. 586.

(1) When the CIP Department or the designated competent authorities become aware in the course of supervision or enforcement that the breach by a critical entity of the obligations established in this order may entail a personal data breach, as defined in Article 4(12) of Regulation (EU) 2016/679, it shall without undue delay, inform the Information and Data Protection Commissioner in accordance with Articles 33, 55 and 56 of Regulation (EU) 2016/679.

(2) When the Information and Data Protection

Commissioner imposes an administrative fine in accordance with Part

VI of the Data Protection Act, the CIP Department, or the designated competent authorities, shall not impose an administrative penalty in accordance with article 24 for a breach in accordance with sub-article

(1) arising from the same conduct as that which was the subject of the administrative fine under Part VI of the said Act. The CIP Department, or the designated competent authorities may however, impose the enforcement measures provided for in article 24.

(3) When the supervisory competent authority is not established in Malta in accordance with Regulation (EU) 2016/679, the CIP Department or the designated competent authorities, shall inform the Information and Data Protection Commissioner of the potential data breach referred to in sub-article (1).