Cyprus

Cyprus operates a GDPR-omnibus regime. The GDPR applies directly as an EU Regulation and is supplemented by Law 125(I) of 2018, the national implementing act, which entered into force on 31 July 2018 and establishes the Office of the Commissioner for Personal Data Protection as the national supervisory authority. The national Law also introduces limited derogations (e.g. age of consent at 14, genetic/biometric data for life-insurance purposes, and international transfer of special-category data).

Lawful bases and special-category rules follow GDPR Arts 6 and 9 as transposed by Law 125(I)/2018. The Law's principal derogation is the age of digital consent, fixed at 14 (below the GDPR default of 16), and a sector carve-out permitting processing of genetic and biometric data for life-insurance underwriting purposes.

Data subject rights (access, rectification, erasure, restriction, objection, portability) follow GDPR Arts 15-22 directly, enforced by the Commissioner. A published Article 60 decision demonstrates the Commissioner's practical handling of access/erasure complaints, including cross-border cooperation with other EU SAs.

Accountability, DPIA, DPO, ROPA, security and breach-notification duties follow GDPR Arts 24-39. Cyprus's national DPIA exemption list (Art 35(5)) has been submitted to and reviewed by the EDPB. Enforcement decisions against the Bank of Cyprus (Arts 5(1)(f), 24(1), 32) evidence active supervision of security-of-processing and accountability duties; a State Health Services Organization fine evidences breach-notification/security enforcement in the health sector.

As an EU Member State, Cyprus applies the GDPR Chapter V transfer regime directly: transfers to third countries rely on European Commission adequacy decisions, SCCs, BCRs or Art 49 derogations. Cyprus does not independently grant or receive adequacy decisions (this is an EU Commission competence); the Commissioner participates in EDPB review of the Commission's adequacy-decision reports.

Sectoral overlays supplementing GDPR/Law 125(I)/2018 include: telecoms/ePrivacy rules under Law 112(I)/2004 (electronic communications and postal services) and the Private Communications Law 92(I)/96 (secrecy of conversations); financial-sector processing supervised jointly by the Commissioner and prudential regulators, evidenced by repeated Bank of Cyprus enforcement actions; and health-sector processing evidenced by the State Health Services Organization fine. No CY-specific credit-scoring, education-sector or insurance-sector statute distinct from GDPR/Law 125(I)/2018 was identified beyond the genetic/biometric life-insurance derogation already noted in module 2.

Cookie and tracker consent follows the ePrivacy Directive as transposed via Law 112(I)/2004, enforced by the Commissioner alongside GDPR. The Commissioner conducted a cookie compliance audit and fined Aylo Freesites Ltd €58,400 for GDPR violations and illegal cookie use, evidencing active adtech/cookie enforcement. Direct marketing is covered by dedicated Commissioner guidelines.

Profiling and automated-decision-making transparency follow GDPR Art 22 directly. The national genetic/biometric derogation for life insurance interacts with the biometric and genetic data sub-modules. No Cyprus-specific AI-risk-assessment regime distinct from the incoming EU AI Act, nor a dedicated facial-recognition/biometric statute, nor a state-surveillance carve-out statute distinct from national-security exemptions in GDPR Art 23/Law 125(I)/2018, was identified in the sources reviewed.

Cyprus sets the digital age of consent at 14 (below the GDPR default of 16), requiring parental/guardian consent for data activities involving users aged 14 and under. The Commissioner has publicly emphasised children's data protection, urging parental, guardian and educator vigilance. No dedicated minor-profiling-ban statute, education-settings-specific DP rule, or dependent-adults-specific regime distinct from the general Law was identified.

The Commissioner holds standard GDPR Art 58 investigative and corrective powers and Art 83 administrative-fining powers, plus Law 125(I)/2018 criminal offences (punishable by imprisonment) for certain violations. Enforcement activity in the last 12-24 months includes fines against Aylo Freesites (€58,400), the State Health Services Organization (€46,500), the Open University of Cyprus (€45,000), the Bank of Cyprus (€17,000 and €8,000), Politis (€7,000), and Arktinos Publishing (€5,000), plus a September 2024 public-sector compliance audit. No dedicated CY collective-redress/class-action mechanism or private-right-of-action statute distinct from GDPR Arts 79-82 was identified.