Online safety in Cyprus: the EU Digital Services Act (2026)

Three legislative instruments implementing EU Regulation 2022/2065 (DSA) were approved by Parliament on 3 July 2025 and published in the Government Gazette on 11 July 2025, entering into force immediately. The Radio Television and Digital Services Authority (formerly the Radio Television Authority) was renamed and designated as Cyprus's Digital Services Coordinator, responsible for overseeing all intermediary service providers and representing Cyprus on the European Board for Digital Services.

Parliament enacted the NIS2 implementation law on 10 April 2025, published on 25 April 2025, amending Law 89(I)/2020 and extending mandatory cybersecurity obligations to 'essential' and 'important' entities across ten critical sectors — expanding coverage from roughly 70 to approximately 700 entities. The Digital Security Authority remains the national competent authority.

The European Commission sent a letter of formal notice to Cyprus (alongside Czechia and Portugal) for failing to designate a Digital Services Coordinator and transpose the Digital Services Act into national law by the required deadline, triggering formal infringement proceedings that ultimately prompted the July 2025 legislation.

The Cyprus government announced plans to amend existing legislation on offensive online material — previously limited to child sexual abuse material and terrorist content — to explicitly include racism, xenophobia, and hate speech, responding to long-standing criticism that Law 134(I)/2011 lacked effective enforcement mechanisms online.

Cyprus enacted Law 89(I)/2020 implementing the EU NIS Directive, establishing the Digital Security Authority as the national competent cybersecurity authority and creating mandatory security and incident-reporting obligations for operators of essential services and digital service providers, covering infrastructure underlying online services.

Cyprus enacted Law 147(I)/2015 transposing EU Directive 2013/40/EU on attacks against information systems, introducing criminal sanctions for illegal system access, data interference, and interception — strengthening the cybercrime criminal law framework beyond the earlier Budapest Convention ratification and covering online platforms and services.

Cyprus enacted Law 134(I)/2011 criminalising the use of computer systems to incite or promote racism, xenophobia, and hatred, punishable by up to five years' imprisonment. This was Cyprus's first dedicated legislative response to online hate speech, though subsequent OSCE and Council of Europe reports noted persistent enforcement challenges.

Cyprus's internet safety hotline was re-launched as SafenetCY in March 2007 by the Cyprus Neuroscience and Technology Institute with EU co-funding under the Safer Internet Plus Programme, providing the public with a reporting channel for child sexual abuse material, grooming, racism, and other illegal online content — Cyprus's primary civil society internet safety mechanism.

Cyprus enacted Law 156(I)/2004 transposing the EU E-Commerce Directive, establishing liability rules for online intermediaries, transparency obligations for online service providers, and rules for electronic contracts. This remains the foundational statute for digital business regulation and online platform obligations in Cyprus.

Cyprus established the Office of the Commissioner for Electronic Communications and Postal Regulation (OCECPR) as an independent authority, creating the institutional structure for regulating electronic communications networks and services. OCECPR became the backbone of internet infrastructure governance and a key participant in EU regulatory bodies such as BEREC.