Is cold email legal in Malta? B2B rules 2026

No, not without prior written consent. Regulation 9(1) of Malta's Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01) bans unsolicited direct marketing by email "irrespective of whether such subscriber or user is a natural person or legal person", unless the recipient has given prior consent in writing. The regulator, the IDPC (Office of the Information and Data Protection Commissioner), says the law requires prior consent for email and has a soft opt-in for earlier customers. Info@ addresses, named employees and sole traders all fall under the same rule. We found no IDPC guidance on LinkedIn messages or on a first email that asks for consent.

Checked on 2 November 2026 against the consolidated law text on legislation.mt, the IDPC's direct marketing page, its published decisions and the EDPB's register of decisions. This is not legal advice.

Malta sits with Greece, Italy, Romania and Germany: consent first, even in B2B. All countries: cold email laws by country.

Malta at a glance

What the law says

Malta implements article 13 of the ePrivacy Directive through S.L. 586.01 (Legal Notice 16 of 2003, as amended; the consolidated text lists amendments up to Legal Notice 429 of 2013, and we found no later amending notice in legislation.mt's list of legal notices). The regulations still name the "Data Protection Commissioner"; that office is now the Information and Data Protection Commissioner, which says it has "a primary role" in these regulations (IDPC). Regulation 9(1) reads:

"A person shall not use, or cause to be used, any publicly available electronic communications service to make an unsolicited communication for the purpose of direct marketing by means of (a) an automatic calling machine; or (b) a facsimile machine; or (c) electronic mail, to a subscriber or user, irrespective of whether such subscriber or user is a natural person or legal person, unless the subscriber or user has given his prior consent in writing to the receipt of such a communication."

That goes further than the directive, which requires consent only for "subscribers who are natural persons" (article 13(5)). Malta wrote the legal-person case into the text itself, so a company is protected as much as a private individual.

"Electronic mail" is defined in regulation 2 as "any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient". Regulation 9(4) bans marketing email that hides the sender or lacks "a valid address to which the recipient may send a request that such communications cease".

What the regulator says

The IDPC's direct marketing page describes S.L. 586.01 as the "lex specialis" for electronic marketing and says the law "stipulates that no person shall send such communication (including communications made by means of an automatic calling machine, a facsimile machine, or email) without having sought the prior consent of the intended recipient". It adds that an opt-out must be included "in every marketing communication".

The page does not say whether companies are covered; the law text does. We found no IDPC statement on info@ addresses, named employees or sole traders, so the answers below follow the text (our reading).

• Info@ addresses: regulation 9(1) protects a subscriber or user whether it is "a natural person or legal person", so a company's own address is covered. Consent first.
• Named employees: the law defines a "user" as a natural person using an electronic communications service "for private or business purposes". A work email to a named person is therefore covered. Consent first.
• Sole traders: a sole trader is a natural person, so the rule applies in the clearest possible way.

We found no answer on whose consent counts for a work address, the employer's or the employee's; our reading is to get it from the person you write to.

The soft opt-in for existing customers

Regulation 9(2) allows a person who "has obtained from his customers their contact details for electronic mail in relation to the sale of a product or a service" to use them for direct marketing "of its own similar products or services". Customers must be able to object "free of charge and in an easy and simple manner" at the time the details are collected and in each message, where they have not refused already. The IDPC describes the same exception: contact details collected in an earlier sale, a similar product, and an opt-out at collection and in every message.

The IDPC's page speaks of consumers; the regulation says "customers". Our reading: a business customer qualifies, a prospect does not.

Can the first email ask for consent?

No guidance found. The regulation exempts no message that asks for consent. Our reading: a cold email whose purpose is to build a marketing list is itself direct marketing, so get consent by another route, such as a form on your website or a conversation the person started.

We also found nothing on what counts as consent "in writing"; GDPR's standard of clear, specific and provable consent is the safe benchmark (our reading).

LinkedIn and social media messages

We found no IDPC guidance and no decision naming LinkedIn or social media direct messages in marketing. The regulation covers "electronic mail", defined as any text, voice, sound or image message over a public communications network that is stored until collected. A LinkedIn message sits in the recipient's inbox until read, so our reading is that a sales DM to a Maltese recipient needs the same prior written consent as an email.

GDPR and the IDPC

GDPR and S.L. 586.01 apply together. The IDPC states that marketing needs a lawful basis under article 6(1) GDPR, where consent and legitimate interests are the usual ones, and that the recipient must always be able to object. That covers the personal data. It does not lift the consent rule for sending: for a prospect, legitimate interest cannot replace regulation 9(1) consent (our reading, since the IDPC calls S.L. 586.01 the specific law).

A named person can object to direct marketing at any time, and after an objection their data may no longer be used for it (article 21(3) GDPR). More in GDPR and B2B email under legitimate interest.

Fines and real cases

Under regulation 13 the Commissioner may impose an administrative fine of up to EUR 23,293.73 "for each violation" and EUR 2,329.37 "for each day during which such violation persists". Appeals go to the tribunal named in regulation 14, now called the Information and Data Protection Appeals Tribunal (Data Protection Act, article 24), and anyone who suffers loss can sue (regulation 11). Where the same conduct breaches GDPR, such as articles 6, 7 or 21, the ceiling is EUR 20 million or 4% of worldwide turnover, whichever is higher (article 83(5) GDPR).

We found no published fine for B2B email in Malta. These are the regulation 9 cases we found on the IDPC's decisions page and in the EDPB's register; none says the recipient was a company:

• October 2019: a company kept sending marketing emails to a customer who had withdrawn consent. The IDPC fined it EUR 15,000 under GDPR (articles 21 and 31) and EUR 2,000 under regulation 9 and regulation 13 (decision, as published on the EDPB site).
• 2020: "unsolicited sending of numerous direct marketing electronic communications without consent and right to object request ignored", breaching articles 6, 7 and 21 GDPR and regulation 9: a EUR 15,000 fine and orders under GDPR article 58(2).
• 2020: unsolicited electronic direct marketing without consent, plus transparency and access failings (articles 13 and 15 GDPR and regulation 9): a EUR 4,000 fine and orders under GDPR article 58(2).
• 2021: unsolicited marketing emails sent without blind carbon copy, breaching article 32(1)(b) GDPR and regulation 9(2): a reprimand and warning, no fine.

A 2024 IDPC fine of EUR 15,000 under GDPR for marketing calls concerns calls, not email.

Checklist for B2B email to Malta

1. Get prior consent in writing before the first commercial message, from the person you write to, and keep proof.
2. Treat info@ addresses, named employees and sole traders alike: all need consent.
3. Do not send an email whose purpose is to ask for marketing consent (our reading).
4. Existing customers: your own similar products only, with an opt-out at collection and in every message.
5. Name the company behind every email and include a working address for stop requests.
6. Inform people under GDPR, keep a suppression list and stop at the first objection.
7. Treat LinkedIn and other DMs like email (our reading).

How Leo handles Malta

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Malta has no such rule. Maltese law requires prior written consent even for company addresses, and in review mode, the default, you read and approve every draft, so whether a Maltese lead has consented is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Maltese consent for you.

More countries: Greece, Italy, Romania, Ireland, Slovakia, Bulgaria, Croatia, Lithuania, Slovenia, Latvia, Cyprus and Iceland.

Common questions

Is B2B cold email legal in Malta?

No, not without prior written consent. Regulation 9(1) of S.L. 586.01 covers every subscriber or user "irrespective of whether such subscriber or user is a natural person or legal person".

Can I email a Maltese company's info@ address without consent?

No. The regulation names legal persons expressly. The IDPC has published no separate guidance on info@ addresses, and the law's only exception is for your existing customers.

Can I send a first email asking for consent in Malta?

No guidance found. The law bans unsolicited direct marketing email without prior written consent and has no exception for a consent request, so in our reading get consent by another route.

Are LinkedIn messages covered in Malta?

We found no guidance naming LinkedIn. The law defines electronic mail as any stored message over a public network, so in our reading a sales DM needs consent too.

What are the fines for cold email in Malta?

Up to EUR 23,293.73 per violation plus EUR 2,329.37 per day under regulation 13, and up to EUR 20 million or 4% of turnover where GDPR is also breached. The only fine we found imposed under regulation 9 itself is EUR 2,000 (October 2019); other marketing fines were under GDPR.