Notification obligation

In terms of article 29 of the Data Protection Act a data controller, any person or organisation processing personal data, shall prior to carrying out any wholly or partially automated or manual processing operations, notify the Information and Protection Commissioner with such processing.

Exemption from the notification obligation

For companies, where the only personal data processed is that contained in the Memorandum and Articles of Association as filed with the Registrar of Companies, no notification of processing operations is required. However when this status is changed, such companies are required to satisfy the notification obligation.

Annual notification fee

The law establishes an annual notification fee of €23.29 which is due by data controllers who are obliged to notify their processing operations to the Information and Data Protection Commissioner.

Exemptions from the notification fee

S.L 440.01​  provides for an exemption from the notification fee for the following:

  • any person carrying out an economic activity including any trade, business or profession, as a self-employed with no employees;

  • any of the following organisations which are exempt from the payment of tax under article 12(1) of the Income Tax Act:
    • philanthropic institutions and any other similar organisations to which paragraph (e) of the said article applies;
    • band clubs;
    • sports clubs and other similar institutions which qualify under paragraph (o) of the said article;
    • registered trade unions;
    • political parties and clubs adhering to political parties.
    • Such exemptions apply without prejudice to the notification requirements as set out in the regulations.


    Personal Data Representative (PDR)

    Under section 30(1) of the Data Protection Act, Data Controllers may elect to appoint a Personal Data Representative and in such case have to notify the Commissioner. The function of the PDR is to independently ensure that the controller processes personal data in a lawful and correct manner and in accordance with good practice.

    Submitting the notification form

    The obligation to complete and submit the notification form is a one time requirement, however the notification fee is due by data controllers on an annual basis. Any amendments to the original form are to be notified to the Information and Data Protection Commissioner accordingly.