S.L. 460.41 Art. 39Infringements entailingapersonal data breach. 

(1) Where the CIP Department, or where designated the competent authority, becomes aware in the course of supervision or enforcement that the infringement by an essential or important entity of the obligations established in articles 19 and, or 20 may entail a personal data breach, as defined in Article 4(12) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) which is to be notified in accordance with Article 32 of the said Regulation, it shall without undue delay, inform the Information and Data Protection Commissioner.

(2) If the natural person is found in breach of his duties, in case of non-compliance by the essential or important entity with this order, the CIP Department, or where designated the competent authority, may proceed against such natural person in accordance with article 31(10)(b).

(3) Where the supervisory authority competent in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), is not established in Malta, the CIP Department, or where designated the competent authority, shall inform the Information and Data Protection Commissioner of the potential data breach referred to in sub-article (1).