The Office of the Information and Data Protection Commissioner (IDPC) has published its Annual Report and Financial Statements 2025, providing an overview of the office's regulatory work, enforcement activities, stakeholder engagements, and key developments in the fields of data protection, freedom of information and artificial intelligence during the year under review.

The report highlights another year of significant activity for the IDPC, reflecting the growing importance of data protection within an increasingly digital society. During 2025, the office continued to safeguard individuals' rights, provide guidance to organisations, participate in European and international initiatives, and contribute to Malta's evolving regulatory framework on emerging technologies, including artificial intelligence.

In his foreword, Dr Reno Borg, Information and Data Protection Commissioner, noted: "I am pleased to present the Annual Report of the Office of the Information and Data Protection Commissioner covering the year 2025 – a year that continued to highlight the central role of data protection in an increasingly complex and rapidly evolving digital landscape."

The Commissioner also highlighted the increasing significance of cross-border cooperation and emerging technologies, particularly following the implementation of the EU Artificial Intelligence Act: "Following the entry into force of the Artificial Intelligence Act, the IDPC has been designated as the Fundamental Rights Authority insofar as the protection of personal data is concerned."

Looking ahead, Dr Borg emphasised the need for a proactive regulatory approach: "Looking ahead, the challenges associated with emerging technologies, increasing data flows, and evolving regulatory frameworks will require a proactive and forward-looking approach."

Key Performance Figures

Among the highlights reported for 2025 were:

• 701 complaints received by the IDPC.
• 182 admissible complaints, of which 75% resulted in a finding of infringement.
• 535 One-Stop-Shop (OSS) cases handled under the GDPR cooperation mechanism, including 517 cases where the IDPC acted as Lead Supervisory Authority.
• 450 OSS cases related to the exercise of the right of access.
• 114 personal data breaches reported to the Office, with the financial sector being the most affected and cyber-attacks remaining the leading cause.
• 667 Freedom of Information requests received by public authorities.
• 52 Freedom of Information applications handled directly by the IDPC.

The report also outlines the office's extensive local and international engagements throughout the year, including participation in the European Data Protection Board's coordinated enforcement activities, international privacy conferences, AI-focused initiatives, stakeholder outreach programmes, and awareness-raising campaigns. The report further details the IDPC's growing role under the EU Artificial Intelligence Act, including its designation as Malta's Fundamental Rights Authority for matters relating to the protection of personal data.

The full Annual Report and Financial Statements 2025 may be accessed here