Cyprus

Regulator And AuthorityGreen

The Commissioner for Personal Data Protection is the sole national supervisory authority and EDPB member for Cyprus, based in Nicosia.

Claims (1):

• The Office of the Commissioner for Personal Data Protection is the national supervisory authority for Cyprus, monitoring application of the GDPR and Law 125(I)/2018.

Act And InstrumentsGreen

Primary instruments are the GDPR and the national implementing Law 125(I)/2018.

Claims (1):

• Cyprus implemented the GDPR by means of Law 125(I) of 2018 Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data, which entered into force on 31 July 2018.

Material ScopeGreen

Material scope follows GDPR Art 2/4 definitions of personal data and processing, as transposed by Law 125(I)/2018; the Law adds sector variations for genetic/biometric data used for life-insurance purposes.

Claims (1):

• Law 125(I)/2018 presents variations from the GDPR relating to the processing of genetic and biometric data for life-insurance purposes and to the international transfer of special categories of personal data.

Territorial ScopeGreen

Territorial scope mirrors GDPR Art 3 (establishment + targeting tests); no CY-specific narrowing identified in the sources reviewed.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , L, a, w, , 1, 2, 5, (, I, ), /, 2, 0, 1, 8, , t, e, r, r, i, t, o, r, i, a, l, , s, c, o, p, e, , d, e, r, o, g, a, t, i, o, n.

Regulator Registration And FilingAmber

No general controller registration/filing requirement was identified beyond GDPR-standard record-keeping and DPO notification practice; the Commissioner's 2024 compliance guide addresses self-assessment rather than filing.

Claims (1):

• The Commissioner published a question-based GDPR compliance guide on 19 February 2024 to help controllers and processors self-assess processing operations, including DPO, legal-basis and transfer sections.

Lawful BasesGreen

The six GDPR Art 6 lawful bases apply directly in Cyprus with no local substitution identified.

Claims (1):

• GDPR Article 6 lawful bases apply directly in Cyprus as an EU Member State without local substitution of the enumerated grounds.

Consent ThresholdsAmber

Consent must be freely given, informed and revocable per GDPR Art 7; Law 125(I)/2018 sets the digital age of consent at 14, below the GDPR default of 16.

Claims (1):

• Law 125(I)/2018 sets the age of consent for information-society services at 14 years old, a derogation from the GDPR default age.

Special CategoriesAmber

Special categories follow GDPR Art 9, with a national derogation permitting genetic and biometric data processing for life-insurance purposes.

Claims (1):

• Law 125(I)/2018 presents variations from the GDPR in relation to the processing of genetic and biometric data for life insurance purposes.

Pseudonymisation And AnonymisationAmber

No Cyprus-specific statutory definition beyond GDPR Art 4(5) pseudonymisation was located in the sources reviewed.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , L, a, w, , 1, 2, 5, (, I, ), /, 2, 0, 1, 8, , p, s, e, u, d, o, n, y, m, i, s, a, t, i, o, n, , a, n, o, n, y, m, i, s, a, t, i, o, n, , s, a, f, e, , h, a, r, b, o, u, r.

Access RightGreen

The Commissioner has directly handled subject-access and erasure complaints, including a documented Article 60 cross-border cooperation case.

Claims (1):

• The Commissioner has exercised her GDPR and Law 125(I)/2018 powers in handling data-subject complaints concerning the right of access and right to erasure, including cross-border Article 60 cooperation.

Rectification And ErasureGreen

Erasure ('right to be forgotten') is enforced alongside access rights per the same Article 60 case practice.

Claims (1):

• The Commissioner has exercised her GDPR and Law 125(I)/2018 powers in handling data-subject complaints concerning the right of access and right to erasure, including cross-border Article 60 cooperation.

Restriction And ObjectionGreen

GDPR Arts 18 and 21 apply directly; no CY-specific narrowing identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , r, e, s, t, r, i, c, t, i, o, n, , o, f, , p, r, o, c, e, s, s, i, n, g, , o, b, j, e, c, t, i, o, n, , r, i, g, h, t, , d, e, r, o, g, a, t, i, o, n.

Data PortabilityGreen

GDPR Art 20 portability right applies directly; no CY-specific derogation identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , d, a, t, a, , p, o, r, t, a, b, i, l, i, t, y, , d, e, r, o, g, a, t, i, o, n, , L, a, w, , 1, 2, 5, (, I, ), /, 2, 0, 1, 8.

Deadlines And Response WindowsGreen

Standard GDPR one-month (extendable to three-month) response window applies; no CY-specific shortening/extension was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , s, t, a, t, u, t, o, r, y, , r, e, s, p, o, n, s, e, , d, e, a, d, l, i, n, e, , v, a, r, i, a, t, i, o, n.

Accountability And DpiaGreen

Cyprus's DPIA exemption list under GDPR Art 35(5) was submitted to and processed through the EDPB's Article 64 consistency mechanism.

Claims (1):

• Cyprus submitted a national DPIA exemption/inclusion list under GDPR Article 35(5), which was reviewed through the EDPB's Article 64 consistency opinion process (DPIA List Cyprus).

Dpo RequirementsGreen

The Commissioner has issued DPO-appointment guidelines and, in a 2022 Bank of Cyprus decision, recommended prior DPO consultation before actions risking GDPR violations.

Claims (1):

• Following a 2022 data-breach decision, the Commissioner recommended that the Bank of Cyprus consult its data protection officer before taking actions that may violate GDPR.

Ropa RequirementsAmber

GDPR Art 30 record-keeping applies directly; the Commissioner's September 2024 public-sector audit found 60% of audited bodies lacked posted data-protection policies/DPO contact details, indicating documentation gaps subsequently remediated.

Claims (1):

• A September 2024 Commissioner audit of 28 public-sector websites found 60% lacked a posted data-protection policy and DPO contact details, with 40% having policies containing gaps and inaccuracies, before full compliance was achieved by August 2024.

Joint Controller ArrangementsGreen

GDPR Art 26/28 joint-controller and processor rules apply directly; no CY-specific supplementary provision was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , j, o, i, n, t, , c, o, n, t, r, o, l, l, e, r, , p, r, o, c, e, s, s, o, r, , a, g, r, e, e, m, e, n, t, , s, u, p, p, l, e, m, e, n, t, a, r, y, , r, u, l, e.

Security MeasuresAmber

The Commissioner fined the Bank of Cyprus €17,000 in November 2022 for violations of Articles 5(1)(f), 24(1) and 32 GDPR following data-security failures involving misdirected shipments.

Claims (1):

• The Office of the Commissioner for Personal Data Protection fined the Bank of Cyprus Public Company Ltd €17,000 for violations of Articles 5(1)(f), 24(1) and 32 GDPR following a data breach involving misdirected letters and electronic files affecting thousands of data subjects.

Breach NotificationAmber

The Commissioner fined the State Health Services Organization €46,500 for GDPR breaches involving lost patient data, evidencing active breach-notification/security enforcement in the health sector.

Claims (1):

• Cyprus fined the State Health Services Organization €46,500 for GDPR breaches involving lost patient data.

Retention And DisposalAmber

The Commissioner has separately guided that hotels may not retain identity-card or passport copies, and that pharmacies must minimise and discreetly handle beneficiary identification data, reflecting retention-minimisation enforcement.

Claims (1):

• Cyprus prohibits hotels from retaining identity card or passport copies due to GDPR violations, and pharmacies must collect beneficiary identification data discreetly to avoid system abuse.

Transfer MechanismsGreen

GDPR Art 44-49 transfer mechanisms (adequacy, SCCs, BCRs, derogations) apply directly to Cyprus-established controllers/processors.

Claims (1):

• As an EU Member State, Cyprus applies GDPR Chapter V (Arts 44-49) transfer mechanisms directly, including adequacy decisions, SCCs, BCRs and Article 49 derogations, without a separate national transfer regime.

Adequacy ReceivedGreen

Adequacy determinations are an EU Commission competence, not a Cyprus national one; Cyprus is bound by whichever adequacy decisions the Commission adopts EU-wide.

Claims (1):

• As an EU Member State, Cyprus applies GDPR Chapter V (Arts 44-49) transfer mechanisms directly, including adequacy decisions, SCCs, BCRs and Article 49 derogations, without a separate national transfer regime.

Adequacy GrantedGreen

Cyprus does not independently grant adequacy; adequacy is granted at EU level under GDPR Art 45, with the EDPB reviewing Commission adequacy-decision reports.

Claims (1):

• The EDPB reviews the European Commission's periodic reports on the functioning of existing adequacy decisions, including methodological observations on government-access assessments, as part of the EU-wide (not Cyprus-specific) adequacy review process.

Sccs And BcrsGreen

Standard Contractual Clauses and Binding Corporate Rules apply under GDPR Arts 46-47; no CY-specific supplementary form was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , n, a, t, i, o, n, a, l, , S, C, C, /, B, C, R, , s, u, p, p, l, e, m, e, n, t, a, r, y, , f, o, r, m, , o, r, , g, u, i, d, a, n, c, e.

Transfer Impact AssessmentAmber

TIA obligations follow the EDPB's general post-Schrems II recommendations; no CY-specific TIA template was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , C, o, m, m, i, s, s, i, o, n, e, r, , t, r, a, n, s, f, e, r, , i, m, p, a, c, t, , a, s, s, e, s, s, m, e, n, t, , g, u, i, d, a, n, c, e.

Data LocalisationGreen

No general data-localisation mandate was identified in Cyprus law beyond GDPR-compliant transfer mechanisms.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , d, a, t, a, , l, o, c, a, l, i, s, a, t, i, o, n, , m, a, n, d, a, t, e.

Financial Sector OverlayAmber

The Commissioner has issued multiple enforcement decisions against the Bank of Cyprus for GDPR security and accountability violations, evidencing active financial-sector DP supervision alongside CBC/prudential oversight.

Claims (1):

• The Bank of Cyprus has been subject to multiple GDPR enforcement decisions by the Commissioner, including a €17,000 fine in 2022 for security-of-processing violations and a further €8,000 fine, evidencing sustained financial-sector DP supervision.

Health Sector OverlayAmber

The Commissioner fined the State Health Services Organization €46,500 for GDPR breaches involving lost patient data, evidencing health-sector DP enforcement.

Claims (1):

• Cyprus fined the State Health Services Organization €46,500 for GDPR breaches involving lost patient data.

Telecoms And EprivacyGreen

Electronic-communications data protection is governed by Law 112(I)/2004 (transposing the EU electronic communications framework) and the Private Communications (Surveillance of Conversations) Law 92(I)/96, alongside GDPR.

Claims (1):

• Law 112(I)/2004 on the Regulation of Electronic Communications and Postal Services is the relevant national telecoms instrument interfacing with data protection in Cyprus.

Employment DataAmber

Employee monitoring is governed by GDPR, Law 125(I)/2018, the Private Communications Law 92(I)/96, and Articles 15/17 of the Cyprus Constitution.

Claims (1):

• Employee monitoring in Cyprus is governed by the GDPR, Law 125(I)/2018, the Protection of the Secrecy of Private Communications (Surveillance of Conversations) Law No. 92(I)/96, and Articles 15 and 17 of the Constitution of the Republic of Cyprus.

Credit And ScoringRed

No CY-specific credit-scoring statute distinct from GDPR/Law 125(I)/2018 was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , c, r, e, d, i, t, , s, c, o, r, i, n, g, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , s, e, c, t, o, r, a, l, , l, a, w.

EducationAmber

No dedicated education-sector DP statute distinct from GDPR/Law 125(I)/2018 was identified, though the Open University of Cyprus has been subject to GDPR enforcement following a cyber-attack.

Claims (1):

• The Open University of Cyprus was fined €45,000 for GDPR violations following a cyber-attack, evidencing education-sector DP enforcement under the general GDPR/Law 125(I)/2018 regime.

InsuranceAmber

Law 125(I)/2018 carries a specific derogation permitting processing of genetic and biometric data for life-insurance purposes.

Claims (1):

• Law 125(I)/2018 presents variations from the GDPR in relation to the processing of genetic and biometric data for life insurance purposes.

Cookies And TrackersAmber

The Commissioner fined Aylo Freesites Ltd €58,400 for GDPR violations and illegal cookie use, and separately published cookie-audit findings highlighting consent and categorisation issues.

Claims (1):

• The Cyprus Commissioner for Personal Data Protection fined Aylo Freesites Ltd €58,400 for GDPR violations and illegal cookie use, and separately reported cookie-audit findings highlighting consent and categorisation issues.

Dark PatternsRed

No CY-specific dark-pattern prohibition distinct from GDPR consent-validity principles was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , d, a, r, k, , p, a, t, t, e, r, n, s, , p, r, o, h, i, b, i, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Opt Out SignalsRed

No Cyprus-specific recognition of browser-level opt-out signals (e.g. GPC) was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , G, l, o, b, a, l, , P, r, i, v, a, c, y, , C, o, n, t, r, o, l, , o, p, t, -, o, u, t, , s, i, g, n, a, l, , r, e, c, o, g, n, i, t, i, o, n.

Clean Rooms And DcrRed

No Cyprus-specific data clean-room or data-collaboration-room regulation was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , d, a, t, a, , c, l, e, a, n, , r, o, o, m, , r, e, g, u, l, a, t, i, o, n.

Cross Context AdvertisingAmber

No Cyprus-specific 'sale'/'share' cross-context advertising framework analogous to US state law was identified; general GDPR consent/legitimate-interest rules apply to ad-tech data sharing.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , c, r, o, s, s, -, c, o, n, t, e, x, t, , a, d, v, e, r, t, i, s, i, n, g, , d, a, t, a, , s, h, a, r, i, n, g, , r, u, l, e.

Direct MarketingGreen

The Commissioner has issued dedicated guidelines on direct marketing under the GDPR/Law 125(I)/2018 framework.

Claims (1):

• The Commissioner has issued guidelines covering direct marketing among other key GDPR compliance topics.

Profiling RestrictionsGreen

GDPR Art 22 profiling restrictions apply directly; no CY-specific narrowing or broadening identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , p, r, o, f, i, l, i, n, g, , r, e, s, t, r, i, c, t, i, o, n, , s, u, p, p, l, e, m, e, n, t, a, r, y, , r, u, l, e.

Automated Decision Making TransparencyGreen

GDPR Art 22 ADM transparency and explanation rights apply directly in Cyprus with no local supplement identified.

Claims (1):

• GDPR Article 22 automated-decision-making transparency and explanation rights apply directly to Cyprus-established controllers under the GDPR/Law 125(I)/2018 framework.

Ai Risk AssessmentsRed

No Cyprus-specific AI risk-assessment statute distinct from the EU AI Act's forthcoming application was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , A, I, , r, i, s, k, , a, s, s, e, s, s, m, e, n, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , l, a, w, , 2, 0, 2, 6.

Biometric RegimeAmber

Beyond the life-insurance genetic/biometric derogation in Law 125(I)/2018, no dedicated facial-recognition or biometric-specific statute was identified.

Claims (1):

• Law 125(I)/2018 presents variations from the GDPR in relation to the processing of genetic and biometric data for life insurance purposes.

Genetic DataAmber

Genetic data processing for life-insurance purposes is subject to the Law 125(I)/2018 derogation noted above.

Claims (1):

• Law 125(I)/2018 presents variations from the GDPR in relation to the processing of genetic and biometric data for life insurance purposes.

State Surveillance CarveoutsRed

No CY-specific national-security surveillance carve-out distinct from GDPR Art 23/Law 125(I)/2018 general exemptions was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , n, a, t, i, o, n, a, l, , s, e, c, u, r, i, t, y, , s, u, r, v, e, i, l, l, a, n, c, e, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , e, x, e, m, p, t, i, o, n.

Age VerificationAmber

The age of consent for information-society services in Cyprus is set at 14, a derogation from the GDPR default of 16.

Claims (1):

• Law 125(I)/2018 sets the age of consent for information-society services at 14 years old, a derogation from the GDPR default age.

Parental ConsentGreen

The Commissioner has stressed the need for companies to secure parental or legal-guardian consent for data activities involving users aged 14 and under.

Claims (1):

• The Cyprus Commissioner for the Protection of Personal Data has stressed the need for companies to ensure parental or legal-guardian consent for data activities related to users aged 14 and under.

Minor Profiling BansRed

No CY-specific statutory ban on profiling of minors distinct from general GDPR Art 22/Recital 71 protections was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , m, i, n, o, r, , p, r, o, f, i, l, i, n, g, , b, a, n, , s, t, a, t, u, t, e.

Education SettingsAmber

No dedicated education-settings DP statute distinct from GDPR/Law 125(I)/2018 was identified, notwithstanding enforcement action involving the Open University of Cyprus.

Claims (1):

• The Open University of Cyprus was fined €45,000 for GDPR violations following a cyber-attack, evidencing education-sector DP enforcement under the general GDPR/Law 125(I)/2018 regime.

Dependent AdultsRed

No CY-specific dependent-adults (elderly/incapacitated) data-protection regime distinct from the general Law was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , d, e, p, e, n, d, e, n, t, , a, d, u, l, t, s, , v, u, l, n, e, r, a, b, l, e, , p, e, r, s, o, n, s, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , r, e, g, i, m, e.

Regulator Powers And PenaltiesGreen

Law 125(I)/2018 provides for criminal offences, punishable with imprisonment, for certain violations of the Law and the GDPR, in addition to standard GDPR administrative fines.

Claims (1):

• Legislation in Cyprus provides for criminal offences, punishable with imprisonment, for certain violations of Law 125(I)/2018 and the GDPR, in addition to the standard GDPR administrative fining regime.

Enforcement Activity IndexGreen

Multiple fines were issued in 2024-2025 spanning adtech (Aylo €58,400), health (State Health Services Organization €46,500), education (Open University €45,000), banking (Bank of Cyprus €17,000/€8,000), media (Politis €7,000, Arktinos €5,000).

Claims (1):

• Recent Commissioner enforcement activity includes fines against Aylo Freesites Ltd (€58,400), the State Health Services Organization (€46,500), the Open University of Cyprus (€45,000), the Bank of Cyprus (€17,000 and €8,000), Politis (€7,000), and Arktinos Publishing Ltd (€5,000).

Regulator Funding And CapacityRed

No specific budget/headcount disclosure for the Commissioner's office was located in the sources reviewed.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , C, o, m, m, i, s, s, i, o, n, e, r, , P, e, r, s, o, n, a, l, , D, a, t, a, , P, r, o, t, e, c, t, i, o, n, , b, u, d, g, e, t, , h, e, a, d, c, o, u, n, t, , a, n, n, u, a, l, , r, e, p, o, r, t.

Collective Redress And Class ActionsRed

No Cyprus-specific collective-redress/class-action mechanism for data-protection claims distinct from GDPR Art 80 representative-action provisions was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , c, o, l, l, e, c, t, i, v, e, , r, e, d, r, e, s, s, , c, l, a, s, s, , a, c, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , G, D, P, R, , A, r, t, i, c, l, e, , 8, 0, , i, m, p, l, e, m, e, n, t, a, t, i, o, n.

Private Right Of ActionGreen

GDPR Arts 79/82 judicial-remedy and compensation rights apply directly; no CY-specific supplementary private right of action was identified.

Absence provenance: unavailable. Searched: C, y, p, r, u, s, , p, r, i, v, a, t, e, , r, i, g, h, t, , o, f, , a, c, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , s, u, p, p, l, e, m, e, n, t, a, r, y.

Recent Developments 180DAmber

Within the last 180 days, Cyprus adopted a Law of 2025 implementing the Digital Services Act (designating competent authorities and fines) and approved amendments to the Network and Information Systems Security Law of 2025, both of which interface with the data-protection enforcement landscape.

Claims (1):

• Cyprus published a Law of 2025 implementing the Digital Services Act, designating competent authorities and outlining fines for non-compliance, and approved the Network and Information Systems Security (Amendment) Law of 2025 enhancing cybersecurity measures and responsibilities.