NIS2 in Malta: what Legal Notice 71 of 2025 means for your hosting provider
A practical guide for Maltese businesses that host a website, a shop or a SaaS application and want to know what the NIS2 Order means for them. As of 30.09.2026.
Short answer
- 1Legal Notice 71 of 2025, the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025, is the Maltese instrument that transposes the NIS2 Directive (EU) 2022/2555. It was published in Government Gazette of Malta No. 21,418 of 08.04.2025 and is also listed as S.L. 460.41 on Legislation Malta.
- 2It does not make every Maltese website owner a regulated entity. It applies to entities that fall within its scope by sector and size, and the test is applied to your business, not to the fact that you rent a server.
- 3If you are in scope, your hosting provider is a supplier in your chain. Under Article 21 of the Directive, supply chain security is one of the risk-management measures an in-scope entity has to address, so you document the provider, the contract, the backups and the incident contacts.
- 4The Directive sets a three-step incident report for significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. The duty sits with the in-scope entity, not with the company that rents it the server.
- 54hosting holds no NIS2, ISO or SOC 2 certification and does not certify your compliance. Status as of 30.09.2026.
What the instrument is, and what we could confirm
On Legislation Malta the Order appears as Legal Notice 71 of 2025 and as subsidiary legislation S.L. 460.41, with the Government Gazette reference above. The full text is served there as an embedded PDF, so the figures below that do not come from the Directive itself are attributed to a named secondary source. Read the Order before you rely on any deadline.
According to the law firm GVZH Advocates, the Critical Infrastructure Protection (CIP) Department acts as the single point of contact and national supervisory authority, and the Malta Communications Authority is designated for digital infrastructure. GVZH also notes that the provisions become enforceable on the dates the Minister specifies. We have not confirmed those dates on a primary source, so this page does not state them. Check Legislation Malta and the CIP Department for the current position.
Where hosting and cloud sit in the NIS2 structure
Annex I of the Directive lists digital infrastructure, which includes cloud computing service providers and data centre service providers, and ICT service management for business customers, which covers managed service providers. A company that resells hosting, runs a data centre or operates managed services for other businesses can therefore be in scope itself.
A shop, a clinic or a software house that only buys hosting is in a different position. It is checked on its own sector and size. If it is in scope, the provider enters its supply chain documentation. If it is not, the same records are still good practice and will matter if a larger customer asks for them.
What a provider can and cannot do for you
A provider can supply infrastructure, a data processing agreement, backups you can restore and people who help you write and rehearse an incident runbook. A provider cannot carry your registration, your notification duty or your legal assessment. Those stay with the entity the Order applies to.
4hosting has no data centre in Malta. Our servers are in the EU, in Frankfurt. Put that location in your supplier records, together with the data processing agreement under Article 28 GDPR.
Three concrete examples
An online shop in Sliema
The shop runs on a VPS and the owner asks whether the Order applies. The right first step is a written check of sector and size with a lawyer or accountant. If the shop is out of scope, nothing to register, but tested backups and updates still reduce the damage of an attack.
A software company in Ta' Xbiex selling to businesses
If an assessment puts the company in scope, it keeps a supplier register. The hosting provider goes in with the contract, the data processing agreement, the backup description and an emergency contact, and the incident plan says who sends the early warning.
Ransomware on a production server
When ransomware locks a server, any reporting clock runs for the in-scope entity. The team that already knows who decides, where the logs are and which backup to restore from loses hours less than the team that starts reading the law during the incident.
Common mistakes
- Assuming that an EU server means you are covered. The obligations attach to the entity in scope, not to the provider of the machine.
- Never checking whether the business is in scope, then discovering it when a customer or the regulator asks.
- Having no written incident procedure, so the first 24 hours are spent deciding who is in charge.
- Leaving the hosting provider out of the supplier register, with no contract reference and no incident contact.
How 4hosting helps
- EU infrastructure in Frankfurt, not in Malta, with DDoS protection at L3/L4 up to 1.5 Tbps included.
- A data processing agreement under Article 28 GDPR, standard contractual clauses for transfers and alignment with ISO 27001. This is alignment, not an ISO 27001 certificate.
- DevOps and CyberSecurity hours included in your plan: Hardening & Compliance, WAF & DDoS, SIEM & Incident Response and CI/CD & Monitoring. You request hours from the client panel; hours above the monthly quota are billed separately.
- 4hosting holds no NIS2, ISO or SOC 2 certification, does not certify your compliance and does not sign legal compliance on your behalf. We do not say here whether 4hosting itself falls within the scope of the Order.
Frequently asked questions
Does NIS2 apply to every website in Malta?
No, not automatically. The Order covers entities in defined sectors and size bands. Check the text on Legislation Malta or ask a lawyer about your own situation.
Does 4hosting certify my NIS2 compliance?
No. 4hosting provides infrastructure, a data processing agreement and DevOps and CyberSecurity services. Compliance remains your responsibility.
Where are 4hosting servers?
In the EU, in Frankfurt. There is no data centre in Malta.