Data-center law in Malta

Environmental Impact Assessment Regulations (S.L. 549.46) as substituted by the Environmental Impact Assessment (Amendment No. 2) Regulations, 2020 (Legal Notice 455 of 2020)

Legal Notice 455 of 2020 was made by the Minister for the Environment, Climate Change and Planning under articles 54 and 55 of the Environment Protection Act, Chapter 549 of the Laws of Malta, after consultation with the Environment and Resources Authority, and substitutes provisions of the Environmental Impact Assessment Regulations, Subsidiary Legislation 549.46.

As substituted, regulation 6(2) requires that the environmental impact assessment be integrated into the development consent procedure and into any other relevant procedures or binding decisions required to comply with the Regulations, or otherwise synchronised with such procedures and decisions as the Authority deems most appropriate.

As substituted, regulation 30(1) requires the Authority to analyse the concluded EIA report, prepare its own final assessment, and take a decision in public giving the applicant and the public an opportunity to comment, and requires the permitting authority to give due consideration to, and clear reference to, the Authority's position in every relevant permit application report.

Source: Full text of law

Data Centres (Sustainability Reporting Obligations) Regulations, S.L. 545.42, Legal Notice 271 of 2025

Applies to both

The regulations transpose Article 12 and Article 26(6) of Directive (EU) 2023/1791 on energy efficiency. Legal Notice 271 of 2025 was published in Government Gazette of Malta No. 21,545 on 28 November 2025. An obligated data centre is any data centre located in Malta, including a co-hosting, colocation or enterprise data centre, with an installed information technology power demand of at least 500 kW.

Regulation 3(1) requires owners and operators of obligated data centres to make the information set out in the First Schedule publicly available by 15 May of every year. Regulation 3(2) exempts data centres used for, or providing their services exclusively with the final aim of, defence and civil protection.

Regulation 4(1) requires operators of obligated data centres to monitor and communicate to the European database on data centres the information and key performance indicators that Commission Delegated Regulation (EU) 2024/1364 and any other delegated act under Article 33(3) of the Directive require. Regulation 4(2) requires those operators to communicate to the European database by 15 May of each year.

Regulation 5 requires data centre operators to put in place any arrangements necessary for obtaining information from customers or third parties. Regulation 6(1) requires data centre operators with a total rated energy input exceeding one megawatt, following 11 October 2025, to utilise waste heat or other waste heat recovery applications, unless they can demonstrate that this is not technically or economically feasible.

Regulation 6(2) requires data centre operators to carry out an installation level cost-benefit analysis under Part A of the Second Schedule, assessing at a minimum technical feasibility, cost-efficiency and the impact on energy efficiency and local heat demand. Under regulation 6(3), the analysis is carried out whenever a data centre with a total rated energy input exceeding one megawatt is newly planned or substantially refurbished.

Under regulation 6(4), within six months of the conclusion of the analysis the data centre operator or the developer must communicate the information listed in Part B of the Second Schedule to the Regulator.

Regulation 6(5) exempts a data centre whose waste heat is used in a district heating network or directly for space heating, domestic hot water preparation or other uses in the building or group of buildings or facilities where it is located, and allows the Regulator to set thresholds for the exemption in terms of the amount of available useful waste heat.

Regulation 8(1) allows the Regulator to impose an administrative penalty on any person who breaches any provision of the regulations or fails to comply with a directive or decision the Regulator gives to ensure compliance. Under regulation 8(2) the administrative penalty may not exceed 5,000 euro for each breach.

Regulation 10 makes it an offence, punishable on conviction by a fine (multa) of not more than 10,000 euro, to act wilfully or through negligence in breach of the regulations, to fail to comply with a lawful order in relation to them, or to make a declaration or submit information that is false, misleading or incorrect in any material respect.

Source: Full text of law