Cyprus

The European General Data Protection Regulation applies directly in Cyprus by virtue of Article 3, so no Cypriot statute needs to extend it. Law 125(I)/2018 (published in the Official Gazette on 31 July 2018, amended by Law 26(I)/2022) supplies the national derogations, the supervisory-authority framework and the criminal offences. Law 44(I)/2019 (published 27 March 2019) transposes the Law Enforcement Directive and names the Police, the Customs Department, the anti-money-laundering unit MOKAS and the Tax Department as competent authorities. The Article 27 in-Union representative obligation is the Regulation's, not a Cypriot addition; Cyprus imposes no separate 'local representative in Cyprus' requirement, checked 18 August 2026.

Sector by sector, checked 18 August 2026: - ALL SECTORS, sensitive data: conditional but with a live regulator gate. Sections 17 and 18 of Law 125(I)/2018 require prior notification (where the transfer rests on Article 46 safeguards or binding corporate rules) or a risk assessment plus prior consultation (where it rests on an Article 49 derogation). In both cases the Commissioner may impose 'explicit limits' for important reasons of public interest. Ignoring those limits is a criminal offence. - ONLINE BETTING: mirror. Class B (online) licensees must install a backup server in the territory of Cyprus connected in parallel to the main server; Class A (shop) licensees' main and backup servers must be and remain installed in the Republic. - INSURANCE: closed, in a narrow slice. Processing genetic and biometric data for health and life insurance purposes is prohibited outright, so the transfer question never arises for that data. - BANKING, PAYMENTS, SECURITIES: no Cypriot localisation rule found. The Digital Operational Resilience Act has applied to financial entities since 17 January 2025 and is the operative regime; the Cyprus Securities and Exchange Commission routes technology-resilience matters to a dedicated Digital Resilience heading rather than to any storage-location rule. - HEALTH: no localisation rule found. The Commissioner's own 2024 opinion allowed a private hospital to give a United States cloud provider remote access to patient records under the EU-US Data Privacy Framework, subject to a proper processor contract. - TELECOMS: no localisation rule found in the electronic-communications privacy law, Law 112(I)/2004. - GOVERNMENT, EDUCATION, MAPPING, DEFENCE: no rule found on a Cypriot government domain; see the unconfirmed list. Regulation (EU) 2018/1807 separately forbids Cyprus from imposing localisation on non-personal data except on public-security grounds.

The approved list is populated and current: Andorra, Argentina, Brazil, Canada (commercial bodies), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, the European Patent Organisation, and the United States for organisations self-certified under the EU-US Data Privacy Framework. The 2021 Standard Contractual Clauses remain the operative set. Sections 17 and 18 of Law 125(I)/2018 are the Cypriot addition and apply only to special categories of personal data — health, genetic, biometric, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex life and sexual orientation. Section 17 requires the controller or processor to 'inform the Commissioner for the intended transfer before the said data are transferred'. Section 18 requires an impact assessment containing the Article 35(7) information plus a description of the security measures, and prior consultation. The Commissioner's power to impose explicit limits is a dormant switch: it needs no consultation and no new law. The Commissioner's 2024 annual report shows her giving a reasoned opinion on exactly this kind of question for a private hospital using a United States cloud provider, so the gate is used in practice.

Fine sizes are small by European standards but the volume is real and the office publishes decisions in batches; the most recent published batch covers January to April 2025. The Commissioner is appointed by the Council of Ministers for a renewable six-year term and must hold the qualifications of a Supreme Court judge. The office changed hands during the period covered here: Irini Loizidou Nicolaidou signed the 2024 annual report and served as Deputy Chair of the European Data Protection Board; the office's own management page names Maria Christofidou as Commissioner as at 18 August 2026, and announcements from January 2026 onwards are issued in her name. The Digital Security Authority, an independent agency supervised by the Commissioner of Communications, enforces the network-security law. It is staffed and visibly operating — running a chief information security officer training programme in August 2026 and taking part in European cybersecurity exercises in June 2026 — but its own public NIS implementation page still describes the pre-2025 categories of operator, so its published guidance lags its statute. The National Betting Authority is operational and issues binding directives; it holds ISO 27001 certification and maintains a live register of licensees.

Cyprus has no general statutory retention schedule and Law 125(I)/2018 sets none. Article 53 of the Betting Law of 2019 sets a five-year floor for betting slips and any other document relating to the provision of betting services, with a further requirement of prior approval from the National Betting Authority before destruction — an unusual second lock that most retention schedules miss. Books and records under that law may be kept electronically only with the Authority's prior approval. Under the network-security law, essential and important entities must file a final incident report within one month and, for a continuing incident, progress reports every fifteen days, which implies retaining incident evidence for at least that long. Tax and company-law floors exist in Cyprus but we could not verify their length or their storage location against a Cypriot government source during this run — see the unconfirmed list.

The six-hour clock comes from Article 35B(4)(a) of the Security of Networks and Information Systems Laws of 2020 and 2025. Trust service providers get 24 hours instead. The 72-hour incident notification must include an initial severity assessment and any indicators of compromise; the Authority is meant to reply within 24 hours of the early warning. A final report is due within one month, and while an incident is still running, progress reports every fifteen days. The privacy clock is the European 72 hours to the Commissioner plus communication to individuals where the risk is high. In Cyprus, failing to notify is not merely a fine: it is a criminal offence under section 33 of Law 125(I)/2018. Failing to notify a severe cyber incident is separately a criminal offence carrying up to two years' imprisonment. The overlap is the trap. A ransomware attack on a Cypriot hospital or bank starts all three clocks at once, and the six-hour one expires before most incident-response teams have finished triage.

(1) Section 33 of Law 125(I)/2018 makes fourteen categories of conduct criminal offences, including failing to keep a record of processing activities, failing to notify a breach, obstructing the data protection officer, and transferring data abroad in breach of Chapter V or of limits the Commissioner has imposed. The penalty is up to three years' imprisonment or a fine of up to EUR 30,000 (about $33,000) or both; up to five years or EUR 50,000 (about $54,000) where the offence damages the interests of the Republic or compromises national security; up to one year or EUR 10,000 (about $11,000) for the residual offences. Section 33(5) is the sting: where the controller is a company, 'the legal responsibility lays with the person designated as the supreme executive instrument or body of the enterprise'. Compliance failure is therefore personal exposure for the chief executive, not just a corporate cost line. (2) Section 8 sets the age of digital consent at 14. Services aimed at 12- and 13-year-olds that rely on the child's own consent elsewhere in Europe will be unlawful in Cyprus. (3) Section 9(1) is an outright prohibition, not a consent-based restriction: genetic and biometric data may not be processed for health and life insurance purposes. Section 9(2) adds that further processing of such data needs separate fresh consent. (4) Sections 17 and 18, above. Note this bites on ordinary corporate architecture — a human-resources system holding sickness records, or a customer database with health flags, replicated to a data centre outside Europe. (5) The six-hour warning under the network-security law. (6) A smaller one: administrative fines on public authorities are capped at EUR 200,000 (about $217,000) where the activity is non-profitable, which materially limits the regulator's leverage over Cypriot ministries and state bodies.

Coming in the next twelve months: - 12 January 2027: the European Data Act requires zero charges for switching cloud provider and for moving data out. This is a contract-renegotiation deadline, not a filing deadline. - The Commissioner has taken on supervision under the Artificial Intelligence Act and under Law 122(I)/2025 implementing the Digital Services Act, on top of privacy. Her own 2024 report flags that the office needs more staff to do this. Expect slower handling times rather than new rules. - A consolidation of the Digital Security Authority with the Office of the Commissioner of Electronic Communications is expressly anticipated in the network-security law's transitional provisions and will trigger amendments to the Authority's structure when it happens. No date is set. DORMANT SWITCHES — powers already held, exercisable without consultation: 1. The Commissioner may impose 'explicit limits' on any transfer of sensitive data out of Europe, for important reasons of public interest, under sections 17(2) and 18(3) of Law 125(I)/2018. She has not published such an order, but the power needs no new law and breaching a limit is a criminal offence. 2. Article 8 of Law 60(I)/2025 has not commenced: it enters into force on a date the Council of Ministers sets by notice in the Official Gazette, which is why the network-security law is recorded here as only partly in force. 3. The National Betting Authority may revise the backup-server specification, including the maximum permitted lag between the main and the Cypriot mirror, by issuing a new directive at any time. At European level the EU-US Data Privacy Framework remains valid but is under appeal at the Court of Justice and was queried by the European Data Protection Board in a letter to the Commission on 31 July 2026. Cypriot controllers relying on it as their only mechanism — as the hospital in the Commissioner's 2024 opinion did — carry that risk.