Regulatory Complaints
Overview
The Malta Digital Innovation Authority (MDIA) has established a formal procedure for regulatory complaints received from natural and legal persons. Complaints may relate to matters falling within the MDIA’s regulatory remit under applicable European Union (EU) and applicable Subsidiary Legislation.
This process ensures that complaints are reviewed fairly, consistently, and confidentially.
Complaints may be submitted in relation to obligations arising under the following Regulations:
- Artificial Intelligence Act*
- Cybersecurity Act
- Cyber Resilience Act*
- Data Act
- Data Governance Act
- Relevant subsidiary legislation and any other regulations falling under MDIA
*Note: The corresponding provisions under the Artificial Intelligence Act and Cyber Resilience Act are still to come into application.
Who Can Submit a Regulatory Complaint
A complaint may be submitted by:
-
Any natural person
-
Any legal person
What is considered as a Regulatory Complaint?
A Regulatory Complaint is a formal submission made by a natural or legal person who believes that a breach of the obligations or rights established under a specific Regulation has occurred.
Such a complaint is recognised when it alleges that:
-
An infringement of the Regulation’s provisions or a breach of rights has taken place;
-
The matter falls within the MDIA’s remit to assess, investigate, and act upon, including through market surveillance or other established procedures; and
-
It was submitted without prejudice to any other administrative or judicial remedies and must be handled by the competent authority in line with the procedures and cooperation mechanisms provided under EU law.
How to Submit a Complaint
Complaints must be submitted using the MDIA Regulatory Complaints Form which can be accessed through the following link.
Supporting documentation should be included with your submission.
Anonymous submissions may be submitted. For such submissions, where no contact details are provided, the MDIA may be unable to acknowledge receipt, request further information, or provide feedback on the outcome.
What to Include in Your Complaint
To allow the MDIA to assess your complaint efficiently, please include:
- Your name and contact details;
- Whether you are acting as an individual or on behalf of an organisation;
- A clear description of the issue;
- The entity or system you are complaining about;
- Dates and relevant events;
- Any supporting documents or evidence; and
- Whether the matter has been referred to another authority or dispute settlement body, where applicable.
Incomplete information may result in delays or inadmissibility.
What Happens After You Submit a Complaint?
Stage 1 – Submission
Once your complaint is received, you will receive an acknowledgement of receipt together with a complaint reference number.
Stage 2 – Admissibility
The MDIA will assess whether the complaint falls within its remit and whether sufficient information has been provided.
Stage 3 – Investigation
If admissible, the complaint will be assigned to the relevant case officers for review and any necessary checks.
You or the subject of the complaint may be contacted for additional details.
Stage 4 – Decision and Notification of Outcome
You will be informed of relevant outcomes, where permitted by law.
Appeals
Where a decision is taken by the MDIA, affected parties have the right to appeal in accordance with the applicable legislation.
Confidentiality and Data Protection
The MDIA treats all complaints with strict confidentiality and in accordance with data protection requirements.