S.L. 586.8 Art. 15Limitations to the right of access. 

(1) The data subject’s right of access may be restricted, wholly or partly, and for as long as such a partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned, for any of the reasons mentioned in regulation 13(3)(a) to (e).

(2) In the cases referred to in sub-regulation (1), the controller shall inform the data subject, without undue delay, and in no later than forty days from receiving the request, in writing of any refusal or restriction of access and of the reasons for the refusal or the restriction:

Provided that the period of forty (40) days may, where necessary, be extended by a period of not more than three (3) months, having regard to the complexity and number of requests. Such complexity may include, the volume, nature and context of inter alia, the personal data processed, the need to retrieve or collate personal data from multiple systems or files, as well as the requirement to consult other authorities, agencies or entities, whether within or outside Malta. In such cases, the controller shall inform the data subject of the extension within forty (40) days of receipt of the request, together with the reasons justifying the delay:

Provided further that information concerning the refusal or restriction of access, and the reasons for such refusal or restriction, or the reasons justifying any delay may be omitted where their disclosure would undermine any purpose under sub-regulation (1). In any case, the controller shall inform the data subject of the possibility of filing a complaint with the Commissioner or seeking a judicial remedy.

(3) The controller shall document the factual or legal reasons on which the decision under sub-regulation (1) and (2) is based and such information shall be made available to the Commissioner.