DATA PROTECTION (FAIR ACCESS TO AND USE OF DATA) REGULATIONS

DATA PROTECTION (FAIR ACCESS TO AND USE OF

DATA)

SUBSIDIARY LEGISLATION 586.13

DATA PROTECTION (FAIR ACCESS TO AND USE OF

DATA) REGULATIONS

10th October, 2025

LEGAL NOTICE 223 of 2025.

(1)

The title of these regulations is the Data

Protection (Fair Access to and Use of Data) Regulations.

(2)

The scope of these regulations is to implement the

requirements of Regulation (EU) 2023/2854 of the European

Parliament and of the Council of 13 December 2023 on harmonised

rules on fair access to and use of data and amending Regulation (EU)

2017/2394 and Directive (EU) 2020/1828 (Data Act).

(1)

In these regulations, unless the context otherwise

requires

"Act" means the Data Protection Act;

"Commissioner" means the Information and Data

Protection Commissioner appointed in accordance with article

11 of the Act;

"Regulation (EU) 2016/679" means Regulation (EU)

2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to

the processing of personal data and on the free movement of

such data, and repealing Directive 95/46/EC (General Data

Protection Regulation);

"Regulation (EU) 2023/2854" means Regulation (EU)

2023/2854 of the European Parliament and of the Council of 13

December 2023 on harmonised rules on fair access to and use

of data and amending Regulation (EU) 2017/2394 and

Directive (EU) 2020/1828 (Data Act).

(1)

The Commissioner shall, in accordance with

Article 37(3) of Regulation (EU) 2023/2854, be the competent

authority responsible for monitoring the application of Regulation

(EU) 2023/2854 insofar as the protection of personal data is

concerned.

(2)

The tasks and powers of the Commissioner as stipulated

in Regulation (EU) 2016/679 and the Act, including the regulations

made thereunder, shall be exercised with regard to the processing of

personal data.

(3)

The Commissioner shall have sufficient human and

DATA PROTECTION (FAIR ACCESS TO AND USE OF

DATA)

technical resources with relevant expertise to effectively carry out his

tasks as competent authority under Regulation (EU) 2023/2854.

Without prejudice to any other administrative or judicial

remedy, every data subject shall have the right to submit a complaint

with the Commissioner in terms of Articles 77(1) or 80(1) of

Regulation (EU) 2016/679 if he considers that the processing of his

personal data under Regulation (EU) 2023/2854 infringes the

provisions of Regulation (EU) 2016/679.

(1)

The Commissioner may within its scope of

competence and in accordance with Article 40(4) of Regulation (EU)

2023/2854, impose administrative fines in accordance with Article 83

of Regulation (EU) 2016/679 and up to the amount referred to in

Article 83(5) of such Regulation, for infringements of the obligations

established in Chapter II, III and V of Regulation (EU) 2023/2854.

(2)

Any person to whom a legally binding decision of the

Commissioner is addressed, shall have the right to appeal in writing to

the Information and Data Protection Appeals Tribunal and the

provisions of Part VII of the Act shall apply mutatis mutandis.