Cold Calling in Malta: The Rules for Calls, SMS, WhatsApp and Email

You have a good service and a list of businesses that could use it. The obvious move is to pick up the phone. Then the doubt creeps in. Is that allowed? What about a quick SMS, or a WhatsApp message? And what if someone complains?

This guide sets out the rules for cold calling in Malta in plain English. It covers live calls, automated calls, SMS, email and WhatsApp, the difference between calling a person and calling a company, what to say when someone answers, and what happens if you get it wrong. We quote the law itself, not a summary of a summary.

One plain note first. This is general information, not legal advice. The law is short, but how it applies to your business depends on the facts. If you are unsure, ask the Information and Data Protection Commissioner (IDPC) or a lawyer about your case.

Yes, if a person makes the call. A live sales call to someone who has not asked to hear from you is allowed in Malta. The condition is simple: when they ask you to stop, you stop. The regulator puts it this way: “Cold calling systems that specifically involve human intervention are permissible, provided that the requests of the called party not to be contacted again are fully respected by the controller making the call” (IDPC, Direct Marketing).

Machines and messages are different. Automated calls, faxes and electronic mail for direct marketing need the person's prior consent in writing, with one narrow exception for your existing customers. So the short version is this:

Two laws work together. The first is the Processing of Personal Data (Electronic Communications Sector) Regulations, S.L. 586.01. It is Malta's version of the EU's ePrivacy Directive, and the IDPC enforces it. The second is the GDPR, which applies whenever you use information about a person, such as their name and number.

Regulation 9 of S.L. 586.01 is headed “Unsolicited communications”. It has four parts, and they are worth reading as written.

Regulation 9(1) says a person “shall not use, or cause to be used, any publicly available electronic communications service to make an unsolicited communication for the purpose of direct marketing by means of (a) an automatic calling machine; or (b) a facsimile machine; or (c) electronic mail” unless the recipient “has given his prior consent in writing”.

Regulation 9(2) is the existing-customer exception, the “soft opt-in”. Regulation 9(3) covers every other means, which includes a live call: you must, “at no charge to the subscriber or user, ensure that any such communications to a subscriber or user are not sent if the subscriber or user requests that such communications cease.” Regulation 9(4) bans marketing emails that hide who sent them or give no valid address for a stop request (S.L. 586.01, IDPC copy).

Note the words “or cause to be used”. If you hire someone to call or message for you, the rules still bite on you.

S.L. 586.01 tells you which channels need consent. The GDPR adds two more questions: on what basis do you use the person's details, and what must you do when they object.

For calls, the usual basis is legitimate interests under Article 6(1)(f) of the GDPR: the processing must be necessary for your legitimate interests, and those interests must not be overridden by the person's rights. Recital 47 says that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Note the word “may”. You still have to weigh your interest against theirs, and it is wise to write that down.

Then there is the right to object. Article 21(2) gives everyone the right to object “at any time” to their data being used for direct marketing. Article 21(3) says that once they object, “the personal data shall no longer be processed for such purposes.” There is no balancing test here and no exception. Article 21(4) adds that this right must be brought to their attention “at the latest at the time of the first communication”, clearly and separately from anything else.

Here is how the two laws apply to each way of reaching a new customer.

No prior consent is needed under S.L. 586.01 for a live call. What you need is a lawful basis under the GDPR (usually legitimate interests), a clear introduction, and a working way to honour a “no”. If someone has asked you before not to call, calling again breaks both regulation 9(3) and Article 21(3).

We found no national do-not-call register in Malta of the kind the UK has. Market summaries say the same (Leadfeeder). That puts the weight on your own list, which we cover below.

An “automatic calling machine” needs prior consent in writing. The Maltese text does not define the term. The ePrivacy Directive it implements describes them as “automated calling and communication systems without human intervention” in Article 13(1).

That plainly covers recorded sales messages. Whether a modern AI voice that holds a conversation counts is not settled in Maltese law. It talks without a person on the line, so the cautious reading is that it does. Do not use one to sell to people who have not agreed in writing.

S.L. 586.01 defines “electronic mail” widely: “any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient.” An SMS fits that description, and the Directive's recital 40 names “e-mails, including SMS messages”.

So a cold SMS or a cold marketing email needs prior consent in writing. “In writing” is the law's phrase. In practice, keep a dated record of how and when each person agreed, and what they agreed to. Every email must also say who it is from and give a valid address for a stop request, under regulation 9(4).

Regulation 9(2) lets you email or text your own customers without fresh consent, but only if all of these hold. You got their contact details “in relation to the sale of a product or a service”. You are marketing “its own similar products or services”. And they were given “the opportunity to object, free of charge and in an easy and simple manner”, both “at the time of their collection and on the occasion of each message”.

In plain terms: a real past sale, your own similar offer, an easy “no” at the till or checkout, and an easy “stop” in every single message. It does not cover a list you bought, an enquiry that never became a sale, or another company's products.

Past customers are often the best place to start selling, because they already know you. If you want to call them back with a reason to return, see how customer reactivation works.

The Maltese regulations do not mention WhatsApp by name. A WhatsApp message is text, voice or image, sent over a network and stored until it is read, which matches the definition of electronic mail above. Whether WhatsApp counts as a “publicly available electronic communications service” for this purpose has not, as far as we found, been ruled on in Malta. The cautious approach is to treat a marketing WhatsApp exactly like an SMS: consent first, or the soft opt-in.

WhatsApp's own rules settle it anyway. Its Business Messaging Policy says you may only contact people who have given you their number and “opt-in permission” to hear from you, and that you “must respect all requests (either on or off WhatsApp)” to stop. Replying to someone who wrote to you first is a different matter. That is how WhatsApp sales should work.

Less than in some countries. Regulation 9(1) applies “irrespective of whether such subscriber or user is a natural person or legal person”. So a cold marketing email or SMS to a company needs prior consent in writing, just as it would to a consumer. There is no general business-to-business exemption for electronic mail in the Maltese text. Linklaters and DLA Piper read it the same way.

For live calls, regulation 9(3) also protects a subscriber or user who asks for calls to stop, and nothing in it limits that to individuals. And the person who answers at a company is a person. Their name, direct line and work email are personal data, so the GDPR and the right to object apply to them too.

The law sets the floor. Good practice decides whether people are glad you called. These three habits cover both.

Say who you are and which business you are calling for, in the first breath. The IDPC is clear that “disguising or concealing the sender’s identity runs counter to the transparency principle and is prohibited by law.” Then tell them, early and plainly, that they can ask not to be called again. Article 21(4) requires that at the first communication.

Be ready for “where did you get my number?”. Under the GDPR, people have a right to know the source of their data. A good opening sounds like this: “Hello, it’s Maria from Borg Tiling in Mosta. I’m calling businesses near you about kitchen refits. Is now a bad time? And if you’d rather we didn’t call, just say and we won’t.”

The IDPC notes that “an exclusion list is normally set up” so a number is not dialled again. Keep one. Put every “stop”, “no thanks, don’t call” and unsubscribe on it, with the date. Check it before every call and every message, across every channel. A “stop” on the phone should also stop the emails.

If you hire someone to call for you, make sure their list and yours are the same list. Asking how they handle a “stop” is one of the points in our guide on what to look out for when outsourcing sales.

We found no Maltese law that sets hours for sales calls. So this is good practice, not law. Call in working hours, avoid lunch and the evening meal, keep Sundays and public holidays free, and do not ring the same number again and again in a day. Courtesy also helps under the GDPR's balancing test: the more intrusive the call, the weaker your case.

Before you pick up the phone, run through this checklist.

The IDPC enforces S.L. 586.01 (regulation 12) and the GDPR in Malta. Anyone can complain through its online complaint form. Complaints must be in Maltese or English, and anonymous complaints are not accepted. Under regulation 16, any aggrieved person may ask the Commissioner to act.

The penalties are real. Under regulation 13, anyone who breaks these regulations is liable to an administrative fine set by the Commissioner for each violation, plus a further amount for each day the breach continues. Ignoring an objection to direct marketing is also a breach of the data subject's rights, which sits in the higher tier of GDPR fines under Article 83(5)(b). Under regulation 11, a person who suffers loss or damage can also sue for compensation. Decisions can be appealed to the Data Protection Appeals Tribunal (regulation 14).

When we run a sales desk for a small business, we follow the law above. We also follow our own rules, which go further. These are our rules, not legal requirements.

Cold calling in Malta is legal, and done well it still works. If you have the time, the checklist above is enough to start.

If you do not have the time, or you would rather someone else carried the list and the rules, that is what we do. Our desk in Malta calls in your name, inside the law and inside our own stricter rules. Talk to our sales team and we will tell you plainly whether calling is right for your business.