Data protection & GDPR compliance in Cyprus (2026)

Parliament enacted the NIS2 transposition law, extending mandatory cybersecurity obligations to a broader set of 'essential' and 'important' entities, imposing 6-hour initial incident-notification deadlines, and making top management personally accountable for cybersecurity governance. The Digital Security Authority gained enhanced fine-setting powers, creating a tighter regulatory perimeter around organisations that process personal data at scale.

The Commissioner fined adult-content platform operator Aylo Freesites Ltd €58,400 for violating the GDPR principles of accountability, transparency, lawfulness, data minimisation, storage limitation and data security, as well as illegal cookie deployment without valid consent. The case was one of the largest fines imposed by Cyprus against a digital content provider and reinforced the Commissioner's enforcement focus on online tracking.

The Office of the Commissioner published findings from an administrative audit of 28 public-sector bodies (ministries, departments, independent offices), revealing 60% initially lacked a GDPR-compliant privacy policy or DPO contact details and 40% had policies with material gaps. All 28 entities achieved full compliance by August 2024 after acting on the Commissioner's recommendations, marking the first systematic government-wide transparency audit.

The Commissioner's Office published a structured compliance guide addressing frequent gaps found in complaints and investigations, covering lawful bases, data subject rights, data breach notification procedures, and DPO appointment requirements. The guidance served as a key soft-law reference for Cypriot organisations navigating Law 125(I)/2018.

The Commissioner fined Bank of Cyprus €17,000 after a personal data breach revealed deficiencies in the bank's technical security measures. The sanction signalled that major financial institutions are not exempt from data-protection accountability and complemented parallel supervisory oversight by the Central Bank of Cyprus.

Larnaca criminal court imposed €76,000 in criminal fines on WS WiSpear Systems Ltd under the criminal provisions of Law 125(I)/2018 for the unlawful collection and processing of personal data via its mobile surveillance rig. Combined with the 2021 administrative fine of €925,000, total sanctions exceeded €1 million — the largest data-protection enforcement action in Cyprus's history.

The Commissioner imposed a €925,000 administrative fine on surveillance firm WS WiSpear Systems Ltd for covertly harvesting MAC addresses and IMSI identifiers from thousands of mobile devices near Larnaca airport using a purpose-built van, breaching GDPR principles of lawfulness, fairness and transparency. The 'spy van' case became a landmark test of whether Cyprus would enforce privacy rights against advanced commercial surveillance.

Cyprus enacted the Protection of Natural Persons with regard to the Processing of Personal Data Law 125(I)/2018, supplementing the directly applicable GDPR, exercising key Member-State derogations (age of consent for children's data set at 16; employment data rules; research exemptions), and repealing the prior Law 138(I)/2001. The law formally re-established and empowered the Commissioner for Personal Data Protection as Cyprus's independent supervisory authority under GDPR Article 51.

Part 14 of the Regulation of Electronic Communications and Postal Services Law 112(I)/2004 (as amended) entered into force, implementing the EU ePrivacy Directive (2002/58/EC as amended by 2009/136/EC). The provisions required opt-in consent for cookies and unsolicited electronic marketing, with the Commissioner for Personal Data Protection designated as the competent enforcement authority alongside OCECPR (the telecoms regulator).

Cyprus enacted the Processing of Personal Data (Protection of Individuals) Law 138(I)/2001, implementing EU Directive 95/46/EC ahead of EU accession (which came in 2004). The law established the Office of the Commissioner for Personal Data Protection as an independent supervisory authority, set out data-subject rights, controller obligations, and registration requirements, and formed the bedrock of Cyprus's privacy framework for nearly two decades until replaced by Law 125(I)/2018.