Cyprus

The European General Data Protection Regulation applies directly in Cyprus under its Article 3. No Cypriot law is needed to extend it. Law 125(I)/2018 supplies the national exceptions, the rules for the regulator's office, and the criminal offences. It was published in the Official Gazette on 31 July 2018 and amended by Law 26(I)/2022. Law 44(I)/2019, published 27 March 2019, brings the Law Enforcement Directive into Cypriot law. It names the Police, the Customs Department, the anti-money-laundering unit MOKAS and the Tax Department as competent authorities. The duty to name a representative inside the European Union comes from Article 27 of the Regulation, not from Cyprus. Cyprus has no separate requirement for a local representative in Cyprus, checked 18 August 2026.

Industry by industry, checked 18 August 2026: - ALL INDUSTRIES, sensitive data: conditions apply, and the regulator can step in. Sections 17 and 18 of Law 125(I)/2018 apply. If the transfer rests on Article 46 safeguards or on binding corporate rules, you must tell the Commissioner first. If it rests on an Article 49 exception, you must do a risk assessment and consult her first. In both cases she may set explicit limits for important reasons of public interest. Ignoring those limits is a crime. - ONLINE BETTING: you must keep a copy in Cyprus. Class B licensees, the online ones, must install a backup server inside Cyprus connected in parallel to the main server. Class A licensees, the shops, must install and keep both their main and backup servers in the Republic. - INSURANCE: banned outright, in one narrow area. Using genetic and biometric data for health and life insurance is prohibited. So the transfer question never arises for that data. - BANKING, PAYMENTS, SECURITIES: we found no Cypriot rule requiring data to stay in the country. The Digital Operational Resilience Act has applied to financial firms since 17 January 2025 and is the governing set of rules. The Cyprus Securities and Exchange Commission handles technology resilience under a dedicated Digital Resilience heading, not under any storage-location rule. - HEALTH: we found no rule requiring data to stay in the country. The Commissioner's own 2024 opinion let a private hospital give a United States cloud provider remote access to patient records. That was under the EU-US Data Privacy Framework, and it needed a proper supplier contract. - TELECOMS: we found no rule requiring data to stay in the country in the electronic communications privacy law, Law 112(I)/2004. - GOVERNMENT, EDUCATION, MAPPING, DEFENCE: we found no rule on a Cypriot government website. See the unconfirmed list. Regulation (EU) 2018/1807 separately bars Cyprus from making non-personal data stay in the country, except on public security grounds.

The approved list is full and current. It covers Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey and the Isle of Man. It also covers Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay and the European Patent Organisation. It also covers the United States for organisations self-certified under the EU-US Data Privacy Framework. The 2021 Standard Contractual Clauses are still the set to use. Sections 17 and 18 of Law 125(I)/2018 are the Cypriot addition. They apply only to special categories of personal data. That means health, genetic and biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life and sexual orientation. Section 17 requires you to tell the Commissioner about the intended transfer before the data moves. Section 18 requires an impact assessment plus consultation with her first. The assessment must contain the information listed in Article 35(7), plus a description of your security measures. The Commissioner can set explicit limits at any time. That power needs no consultation and no new law. Her 2024 annual report shows her giving a reasoned opinion on exactly this kind of question. It concerned a private hospital using a United States cloud provider. So the power does get used.

Fines are small by European standards, but the volume is real. The office publishes decisions in batches. The most recent published batch covers January to April 2025. The Council of Ministers appoints the Commissioner for a renewable six-year term. She must hold the qualifications of a Supreme Court judge. The office changed hands during the period covered here. Irini Loizidou Nicolaidou signed the 2024 annual report and served as Deputy Chair of the European Data Protection Board. The office's own management page names Maria Christofidou as Commissioner as at 18 August 2026. Announcements from January 2026 onwards are issued in her name. The Digital Security Authority enforces the network security law. It is an independent agency supervised by the Commissioner of Communications. It is staffed and visibly operating. It ran a chief information security officer training programme in August 2026. It took part in European cybersecurity exercises in June 2026. But its own public NIS page still describes the categories of operator used before 2025. So its published guidance is behind its own law. The National Betting Authority is operational and issues binding directives. It holds ISO 27001 certification and keeps a live register of licensees.

Cyprus has no general legal keeping schedule, and Law 125(I)/2018 sets none. Article 53 of the Betting Law of 2019 sets a five-year minimum for betting slips. It covers any other document about the supply of betting services too. It adds a second lock that most keeping schedules miss. You need the National Betting Authority's approval before you destroy them. Books and records under that law may be kept electronically only with the Authority's prior approval. Under the network security law, essential and important entities must file a final incident report within one month. For an incident that is still running, they must file progress reports every fifteen days. That implies keeping incident evidence at least that long. Cyprus also has tax and company law minimum periods. We could not confirm their length or their storage location against a Cypriot government source. See the unconfirmed list.

The six-hour deadline comes from Article 35B(4)(a) of the Security of Networks and Information Systems Laws of 2020 and 2025. Trust service providers get 24 hours instead. The 72-hour report must include a first assessment of how serious the incident is, plus any indicators of compromise. The Authority is meant to reply within 24 hours of the early warning. A final report is due within one month. While an incident is still running, you file progress reports every fifteen days. The privacy deadline is the European 72 hours to the Commissioner. You must also tell the affected people where the risk is high. In Cyprus, failing to report is not just a fine. It is a crime under section 33 of Law 125(I)/2018. Failing to report a severe cyber incident is a separate crime, carrying up to two years in prison. The overlap is the trap. A ransomware attack on a Cypriot hospital or bank starts all three deadlines at once. The six-hour one runs out before most incident response teams have worked out what happened.

(1) Section 33 of Law 125(I)/2018 makes fourteen kinds of conduct crimes. These include failing to keep a record of your data activities, failing to report a breach, and obstructing the data protection officer. They also include sending data abroad in breach of Chapter V, or in breach of limits the Commissioner has set. The penalty is up to three years in prison, or a fine of up to 30,000 euros (about 33,000 US dollars), or both. It rises to five years or 50,000 euros (about 54,000 US dollars) where the offence damages the interests of the Republic or compromises national security. The remaining offences carry up to one year or 10,000 euros (about 11,000 US dollars). Section 33(5) is the sting. Where a company decides how data is used, the legal responsibility sits with the person named as the top executive of the business. So getting this wrong exposes the chief executive personally, not just the company budget. (2) Section 8 sets the age of digital consent at 14. A service aimed at 12 and 13 year olds that relies on the child's own consent elsewhere in Europe will be unlawful in Cyprus. (3) Section 9(1) is a flat ban, not a consent rule. Genetic and biometric data may not be used for health and life insurance purposes. Section 9(2) adds that any further use of such data needs separate fresh consent. (4) Sections 17 and 18, described above. Note this catches ordinary company setups. It covers a human resources system holding sickness records. It also covers a customer database with health flags, copied to a data centre outside Europe. (5) The six-hour warning under the network security law. (6) A smaller one. Administrative fines on public authorities are capped at 200,000 euros (about 217,000 US dollars) where the activity is not for profit. That badly limits the regulator's leverage over Cypriot ministries and state bodies.

Coming in the next twelve months: - 12 January 2027: the European Data Act requires no charge for switching cloud provider and for moving data out. This is a deadline for renegotiating contracts, not for filing anything. - The Commissioner has taken on supervision under the Artificial Intelligence Act. She has also taken on Law 122(I)/2025, which implements the Digital Services Act. That is on top of privacy. Her own 2024 report says the office needs more staff to do this. Expect slower handling times rather than new rules. - The network security law expects the Digital Security Authority to merge with the Office of the Commissioner of Electronic Communications. That will trigger changes to the Authority's structure when it happens. No date is set. POWERS ALREADY HELD, USABLE WITH NO CONSULTATION: 1. The Commissioner may set explicit limits on any transfer of sensitive data out of Europe, for important reasons of public interest. That comes from sections 17(2) and 18(3) of Law 125(I)/2018. She has not published such an order. But the power needs no new law, and breaking a limit is a crime. 2. Article 8 of Law 60(I)/2025 has not started yet. It starts on a date the Council of Ministers sets by notice in the Official Gazette. That is why we record the network security law as only partly in force. 3. The National Betting Authority may change the backup server specification at any time by issuing a new directive. That includes the maximum lag allowed between the main server and the Cypriot mirror. At European level the EU-US Data Privacy Framework is still valid. But it is under appeal at the Court of Justice. The European Data Protection Board queried it in a letter to the Commission on 31 July 2026. If it is your only route, you carry that risk. The hospital in the Commissioner's 2024 opinion is an example.