--- title: "Cyprus Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/cyprus/ source_html: /jurisdictions/cyprus/index.html description: "Cyprus data protection and privacy regulation: 10 categories, 41 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: da85b42c7d38210d8c4ec6015f8504943a14439924b9c464c4ed1443b600aabb generator: "fe-fleet/md-twin@1.0" --- # Cyprus Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/cyprus/), [World Payments](https://payments.gi/jurisdictions/cyprus/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 41 claims · 25 sources in the cumulative register Download report (PDF) Expand all Cyprus's data-protection and digital-regulation architecture saw two notable developments this cycle, one at the EU level with direct implications for the Commissioner for Personal Data Protection's cross-border work, and one domestic enforcement decision. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Lawful Processing & Special Data, Cross-Border & Adequacy, AdTech & Commercial Privacy, Children & Vulnerable Groups (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CYPRUS)[Build Report](/reports/?j=CYPRUS)[Compare](/compare/?j=CYPRUS) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Commissioner for Personal Data Protection Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 0 Red categories 57 Sub-modules 41 Claims 5 Tier-1 sources Traffic-light mix 6 green 4 amber (sums to 10 rendered categories; click to filter) No red categories; 10 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Cyprus is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Cyprus’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,216 Full executive summary 242 ###### Latest update · 25 October 2026 #### Lead Signal Cyprus's data protection authority has recorded a concrete enforcement outcome this period: the Office of the Commissioner for Personal Data Protection imposed an administrative fine of EUR 6,000 on the 'Agora' app or platform, whose controller is named as Fidias Panayiotou, on 23 September 2026. The fine followed the controller's failure to comply with a demand from the Commissioner to suspend processing and a broader lack of cooperation with the authority during its inquiry. This is a modest fine in absolute terms when set against the GDPR's tiered maximum penalty structure, but it is a confirmed, dated enforcement action naming the Commissioner directly, and it signals that the authority is willing to act on non-cooperation specifically, independent of the severity of any underlying processing violation. #### Other Developments Separately, Cyprus has moved on the artificial-intelligence governance front. The Council of Ministers designated the country's national competent authorities under Article 70 of the EU Artificial Intelligence Act by decision dated 22 January 2025, naming the Commissioner of Communications as the notifying authority, the market-surveillance authority, and the single point of contact for AI Act matters in Cyprus. That institutional designation is understood to have been in place for some time, but it takes on fresh relevance against a separate EU-wide development: the AI Act's high-risk AI system obligations deadline, originally set for 2 August 2026, is reported to have been deferred under the EU's Digital Omnibus package, which has been in force since 27 July 2026. Under the deferral, stand-alone high-risk systems falling under Annex III of the Act now face a compliance deadline of 2 December 2027, while high-risk AI embedded within already-regulated products has until 2 August 2028. As a directly applicable EU Regulation, this deferral applies in Cyprus without need for separate national transposition. #### Cross-Monitor Connections The AI Act authority-designation and deadline-deferral findings touch on the artificial-intelligence monitor's domain, since the substantive high-risk-system obligations and their revised timeline are AI Act matters properly analysed there; the data-protection angle here is limited to the national competent-authority designation and the Cyprus-applicable deadline shift itself, not the substance of the high-risk compliance regime. #### Outlook The Commissioner's enforcement action against the Agora platform's controller is a useful marker of the authority's current enforcement posture, but the available reporting does not make clear whether a primary decision document has been published or whether further penalties attach to the underlying processing conduct beyond the non-cooperation fine; that detail would sharpen the picture considerably if it surfaces. On the AI Act side, with the compliance clock now reset to December 2027 for stand-alone high-risk systems, Cyprus-based organisations deploying or developing such systems have a materially longer runway than previously understood, and the next marker to watch for is any Cyprus-specific implementing guidance the Commissioner of Communications issues in its capacity as the designated national authority. 1 earlier update not shown here. ###### Standing brief · as of 5 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Cyprus's data-protection and digital-regulation architecture saw two notable developments this cycle, one at the EU level with direct implications for the Commissioner for Personal Data Protection's cross-border work, and one domestic enforcement decision. Regulation (EU) 2025/2518, which lays down additional procedural rules for the enforcement of the GDPR in cross-border cases, is understood to apply from April 2027 and will bind the Cyprus Commissioner in cross-border cooperation procedures with other EU supervisory authorities, though the Official Journal text itself was not directly retrieved this cycle and the finding rests on secondary commentary. Separately, the European Commission is reported to have referred Cyprus to the Court of Justice of the European Union over a lack of effective implementation of the Digital Services Act, with Cyprus's Radio Television and Digital Services Authority serving as Digital Services Coordinator and the Commissioner for Personal Data Protection separately designated as competent authority for the Digital Services Act's privacy-specific provisions; the exact referral date and case number were not located this cycle, so this finding is treated as uncertain. On enforcement, the Commissioner for the Protection of Personal Data imposed a EUR 6,000 administrative fine, made public on 23 September 2026, on the controller of the Agora Direct Democracy platform for failing to comply with the Commissioner's request to temporarily suspend the platform's data processing during an investigation. The controller is reported to be contesting the fine in court. This is a confirmed finding, though the full text of the Commissioner's decision was not itself retrieved, with the finding resting on press reporting from Cyprus Mail. #### Other Developments Agora platform enforcement reflects an investigation-non-cooperation finding rather than a substantive processing violation. The EUR 6,000 fine was imposed specifically for the controller's failure to comply with the Commissioner's request to temporarily suspend processing during an ongoing investigation, which is a procedural compliance-with-regulator finding distinct from a finding on the underlying lawfulness of the platform's data processing itself. The controller's own public position, as reported, maintains that the data protection authority operates independently and does not act politically, indicating the matter remains contested rather than settled. Cyprus's administrative and criminal penalty architecture under Law 125(I)/2018 remains the standing enforcement baseline. Separate from the GDPR's own Article 83 fine tiers, the Commissioner may impose administrative fines of up to EUR 200,000 on public authorities and bodies for violations relating to non-profitable activities under Section 32(3) of the Law. Certain breaches, including of Articles 30, 31, 33, 34, 35 and 42 of the GDPR and of Chapter V governing international transfers, are additionally criminal offences under Cyprus law, carrying penalties of up to five years' imprisonment and a fine of up to EUR 50,000. This standing architecture was not itself the subject of a new development this cycle, but it provides the backdrop against which the Agora fine, a modest EUR 6,000 administrative penalty, should be read as a relatively low-end application of a framework capable of considerably more severe sanction, including criminal liability, where the underlying facts support it. #### Cross-Monitor Connections The reported Court of Justice of the European Union referral over Cyprus's Digital Services Act implementation connects to broader EU digital-regulation architecture that falls within the remit of the artificial-intelligence and advennt monitors to the extent those track platform-governance and digital-services obligations beyond the data-protection-specific competence held here by the Commissioner for Personal Data Protection. This brief does not re-analyse the Digital Services Act's substantive platform-governance requirements, confining its interest to the Commissioner's role as the designated competent authority for the Act's privacy-specific provisions. #### Outlook Regulation (EU) 2025/2518's cross-border GDPR enforcement procedure is understood to apply from April 2027, at which point the Cyprus Commissioner will operate under additional binding procedural rules in cross-border cooperation cases; confirmation of this date against the Official Journal text remains outstanding. The reported Court of Justice of the European Union referral over Digital Services Act implementation, if confirmed, represents a point of EU-level pressure on Cyprus's digital-services architecture independent of the data-protection framework proper, though the precise referral details require further confirmation. On enforcement, the Agora platform fine is being contested in court by the controller, and the outcome of that challenge may clarify how Cyprus courts treat the Commissioner's authority to compel suspension of processing during an active investigation. Read full brief · 1216 words Standing brief, as of 25 October 2026. #### Regulatory Status Cyprus's data protection enforcement authority took a concrete, dated enforcement action this period, imposing a EUR 6,000 fine on the controller of the 'Agora' app or platform, Fidias Panayiotou, on 23 September 2026, for failing to comply with a suspension-of-processing demand and for lack of cooperation with the authority's inquiry. Separately, Cyprus's institutional architecture for the EU Artificial Intelligence Act is now in place, with the Commissioner of Communications designated by Council of Ministers decision on 22 January 2025 as the national notifying authority, market-surveillance authority, and single point of contact under Article 70 of the Act. The substantive high-risk AI obligations those designations will eventually police have themselves been deferred at EU level under the Digital Omnibus package, in force since 27 July 2026, with stand-alone high-risk systems now facing a 2 December 2027 deadline and high-risk AI embedded in already-regulated products facing 2 August 2028, both directly applicable in Cyprus without separate transposition. #### Outlook The Agora enforcement action is a useful recent marker of the Commissioner's willingness to act on non-cooperation, though the underlying processing conduct that triggered the original inquiry remains undocumented in the available record. On the AI Act side, Cyprus's designated authority is now institutionally ready, but with the compliance clock reset to December 2027 for stand-alone high-risk systems, the practical test of how the Commissioner of Communications will exercise its new powers is still some way off. Read full brief · 242 words Key regulatory facts for Cyprus Regulatory Dimension Cyprus Standing Position Jurisdiction Cyprus (CY) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 41 sourced findings) Regulator & Framework Comprehensive omnibus statute in force with an operational, EDPB-recognised supervisory authority. Lawful Processing & Special Data GDPR Art 6/9 bases apply directly; national derogations are narrow and well-documented. Data Subject Rights Full GDPR rights suite in force with documented enforcement practice via Article 60 cooperation decisions. Controller/Processor Duties Full GDPR controller/processor duty regime in force with multiple documented enforcement actions on security and accountability failures. Primary Instruments Cited European Data Protection Board, DataGuidance (summarising official Cyprus Gazette text), DataGuidance, Cyprus Official Instrument (linklaters.com data-protected---cyprus), Cyprus Official Instrument (zenolegal.com cyprus-gdpr-compliance-2026) Last Confirmed / Updated 2026-10-25 (25 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Cyprus: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive omnibus statute in force with an operational, EDPB-recognised supervisory authority. Primary framework GDPR (Regulation (EU) 2016/679) as implemented by Law 125(I) of 2018 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Green Comprehensive omnibus statute in force with an operational, EDPB-recognised supervisory authority. #### Sub-modules (5) #### Regulator And AuthorityGreen The Commissioner for Personal Data Protection is the sole national supervisory authority and EDPB member for Cyprus, based in Nicosia. Claims (1): - The Office of the Commissioner for Personal Data Protection is the national supervisory authority for Cyprus, monitoring application of the GDPR and Law 125(I)/2018. #### Act And InstrumentsGreen Primary instruments are the GDPR and the national implementing Law 125(I)/2018. Claims (3): - Cyprus implemented the GDPR by means of Law 125(I) of 2018 Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data, which entered into force on 31 July 2018. - European Union — Regulation (EU) 2025/2518, laying down additional procedural rules for the enforcement of the GDPR in cross-border cases, will apply from April 2027 and will bind the Cyprus Commissioner in cross-border cooperation procedures. - Office of the Commissioner for Personal Data Protection, Cyprus — Law 125(I)/2018 is Cyprus's GDPR-implementing statute, dealing with national derogations (employment data Art 27; health/scientific-research processing; journalistic/academic purposes Art 29) and establishing the Office of the Commissioner for Personal Data Protection as sole national supervisory authority; it also sets the age of digital consent at 14 #### Material ScopeGreen Material scope follows GDPR Art 2/4 definitions of personal data and processing, as transposed by Law 125(I)/2018; the Law adds sector variations for genetic/biometric data used for life-insurance purposes. Claims (2): - Law 125(I)/2018 presents variations from the GDPR relating to the processing of genetic and biometric data for life-insurance purposes and to the international transfer of special categories of personal data. - The European Commission referred Cyprus to the CJEU for lack of effective implementation of the Digital Services Act (Regulation (EU) 2022/2065); Cyprus's Digital Services Coordinator is the Radio Television and Digital Services Authority, with the Commissioner for Personal Data Protection separately designated as competent authority for the DSA's privacy-specific provisions. #### Territorial ScopeGreen Territorial scope mirrors GDPR Art 3 (establishment + targeting tests); no CY-specific narrowing identified in the sources reviewed. #### Regulator Registration And FilingAmber No general controller registration/filing requirement was identified beyond GDPR-standard record-keeping and DPO notification practice; the Commissioner's 2024 compliance guide addresses self-assessment rather than filing. Claims (1): - The Commissioner published a question-based GDPR compliance guide on 19 February 2024 to help controllers and processors self-assess processing operations, including DPO, legal-basis and transfer sections. Cyprus operates a GDPR-omnibus regime. The GDPR applies directly as an EU Regulation and is supplemented by Law 125(I) of 2018, the national implementing act, which entered into force on 31 July 2018 and establishes the Office of the Commissioner for Personal Data Protection as the national supervisory authority. The national Law also introduces limited derogations (e.g. age of consent at 14, genetic/biometric data for life-insurance purposes, and international transfer of special-category data). No periodic updates recorded in this cycle Sources and claims (7) - [European Data Protection Board](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) — The Office of the Commissioner for Personal Data Protection is the national supervisory authority for Cyprus, monitoring application of the GDPR and Law 125(I)/2018. - [DataGuidance (summarising official Cyprus Gazette text)](https://www.dataguidance.com/jurisdictions/cyprus) — Cyprus implemented the GDPR by means of Law 125(I) of 2018 Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data, which entered into force on 31 July 2018. - [DataGuidance](https://www.dataguidance.com/jurisdictions/cyprus) — Law 125(I)/2018 presents variations from the GDPR relating to the processing of genetic and biometric data for life-insurance purposes and to the international transfer of special categories of personal data. - [DataGuidance](https://www.dataguidance.com/news/cyprus-commissioner-publishes-guidance-compliance-gdpr) — The Commissioner published a question-based GDPR compliance guide on 19 February 2024 to help controllers and processors self-assess processing operations, including DPO, legal-basis and transfer sections. - [https://www.linklaters.com/en/insights/data-protected/data-protected---cyprus](https://www.linklaters.com/en/insights/data-protected/data-protected---cyprus) — European Union — Regulation (EU) 2025/2518, laying down additional procedural rules for the enforcement of the GDPR in cross-border cases, will apply from April 2027 and will bind the Cyprus Commissioner in cross-border cooperation procedures. - [DataGuidance](https://www.dataguidance.com/jurisdictions/cyprus) — The European Commission referred Cyprus to the CJEU for lack of effective implementation of the Digital Services Act (Regulation (EU) 2022/2065); Cyprus's Digital Services Coordinator is the Radio Television and Digital Services Authority, with the Commissioner for Personal Data Protection separately designated as competent authority for the DSA's privacy-specific provisions. - [https://www.zenolegal.com/resources/cyprus-gdpr-compliance-2026](https://www.zenolegal.com/resources/cyprus-gdpr-compliance-2026) — Office of the Commissioner for Personal Data Protection, Cyprus — Law 125(I)/2018 is Cyprus's GDPR-implementing statute, dealing with national derogations (employment data Art 27; health/scientific-research processing; journalistic/academic purposes Art 29) and establishing the Office of the Commissioner for Personal Data Protection as sole national supervisory authority; it also sets the age of digital consent at 14 ### Cyprus: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR Art 6/9 bases apply directly; national derogations are narrow and well-documented. Primary framework GDPR Arts 6, 7, 9 as implemented by Law 125(I) of 2018 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Green GDPR Art 6/9 bases apply directly; national derogations are narrow and well-documented. D2 · Lawful Processing — Full Module Record 4 sub-modules · 50 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Full GDPR rights suite in force with documented enforcement practice via Article 60 cooperation decisions. Primary framework GDPR Arts 12-23 as implemented by Law 125(I) of 2018 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Green Full GDPR rights suite in force with documented enforcement practice via Article 60 cooperation decisions. #### Sub-modules (5) #### Access RightGreen The Commissioner has directly handled subject-access and erasure complaints, including a documented Article 60 cross-border cooperation case. Claims (1): - The Commissioner has exercised her GDPR and Law 125(I)/2018 powers in handling data-subject complaints concerning the right of access and right to erasure, including cross-border Article 60 cooperation. #### Rectification And ErasureGreen Erasure ('right to be forgotten') is enforced alongside access rights per the same Article 60 case practice. Claims (1): - The Commissioner has exercised her GDPR and Law 125(I)/2018 powers in handling data-subject complaints concerning the right of access and right to erasure, including cross-border Article 60 cooperation. #### Restriction And ObjectionGreen GDPR Arts 18 and 21 apply directly; no CY-specific narrowing identified. #### Data PortabilityGreen GDPR Art 20 portability right applies directly; no CY-specific derogation identified. #### Deadlines And Response WindowsGreen Standard GDPR one-month (extendable to three-month) response window applies; no CY-specific shortening/extension was identified. Claims (1): - Cyprus data controllers and processors — Organisations must respond to data-subject access, rectification, erasure, restriction and portability requests within the GDPR one-month timeframe; secondary commentary states failure to respond is a common source of Commissioner complaints Data subject rights (access, rectification, erasure, restriction, objection, portability) follow GDPR Arts 15-22 directly, enforced by the Commissioner. A published Article 60 decision demonstrates the Commissioner's practical handling of access/erasure complaints, including cross-border cooperation with other EU SAs. Sources and claims (2) - [European Data Protection Board / Cyprus Commissioner](https://www.edpb.europa.eu/sites/default/files/article-60-final-decisions/publishable_cy_2019-11_right_of_access_and_right_to_erasure_decisionpublic.pdf) — The Commissioner has exercised her GDPR and Law 125(I)/2018 powers in handling data-subject complaints concerning the right of access and right to erasure, including cross-border Article 60 cooperation. - [https://resguard-solutions.com/blog/en/cyprus-gdpr-data-protection-guide/](https://resguard-solutions.com/blog/en/cyprus-gdpr-data-protection-guide/) — Cyprus data controllers and processors — Organisations must respond to data-subject access, rectification, erasure, restriction and portability requests within the GDPR one-month timeframe; secondary commentary states failure to respond is a common source of Commissioner complaints ### Cyprus: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR controller/processor duty regime in force with multiple documented enforcement actions on security and accountability failures. Primary framework GDPR Arts 24-39 as implemented by Law 125(I) of 2018 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Green Full GDPR controller/processor duty regime in force with multiple documented enforcement actions on security and accountability failures. D4 · Controller & Processor — Full Module Record 7 sub-modules · 60 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Standard GDPR Chapter V mechanisms apply with no CY-specific localisation mandate identified. Primary framework GDPR Arts 44-49 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Green Standard GDPR Chapter V mechanisms apply with no CY-specific localisation mandate identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 56 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and telecoms overlays are well evidenced; credit-scoring, education and insurance sub-modules lack dedicated sectoral instruments beyond the general Law and are marked amber/gap. Primary framework GDPR + Law 125(I)/2018, overlaid by Law 112(I)/2004 (electronic communications) and Law 92(I)/96 (private communications) Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Amber Financial and telecoms overlays are well evidenced; credit-scoring, education and insurance sub-modules lack dedicated sectoral instruments beyond the general Law and are marked amber/gap. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 77 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/tracker and direct-marketing enforcement is well evidenced; dark-patterns, opt-out-signal (GPC-style) and clean-room/cross-context-advertising specific rules were not located. Primary framework ePrivacy Directive 2002/58/EC (as amended) transposed via Law 112(I)/2004, and GDPR Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Amber Cookie/tracker and direct-marketing enforcement is well evidenced; dark-patterns, opt-out-signal (GPC-style) and clean-room/cross-context-advertising specific rules were not located. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 51 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core Art 22 ADM protections are in force; biometric-specific, AI-risk-assessment and surveillance-carveout sub-modules rely on the general GDPR framework with no CY-specific instrument located. Primary framework GDPR Art 22 as implemented by Law 125(I) of 2018 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Amber Core Art 22 ADM protections are in force; biometric-specific, AI-risk-assessment and surveillance-carveout sub-modules rely on the general GDPR framework with no CY-specific instrument located. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 60 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-of-consent and parental-consent sub-modules are well evidenced; minor-profiling-ban, education-settings and dependent-adults sub-modules rely on the general regime with no dedicated instrument located. Primary framework Law 125(I) of 2018 (age of consent derogation) and GDPR Art 8 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Amber Age-of-consent and parental-consent sub-modules are well evidenced; minor-profiling-ban, education-settings and dependent-adults sub-modules rely on the general regime with no dedicated instrument located. D9 · Children's Privacy — Full Module Record 5 sub-modules · 58 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Cyprus: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Regulator possesses full GDPR enforcement powers and demonstrates sustained enforcement activity across sectors within the last 24 months. Primary framework GDPR Arts 58, 77-84, as implemented by Law 125(I) of 2018 Supervisory authority [Office of the Commissioner for Personal Data Protection](http://www.dataprotection.gov.cy/) Traffic-light rationale — Green Regulator possesses full GDPR enforcement powers and demonstrates sustained enforcement activity across sectors within the last 24 months. Periodic update · new data 2026-10-25 #### Enforcement & Redress Cyprus's Office of the Commissioner for Personal Data Protection imposed an administrative fine of EUR 6,000 on the 'Agora' app or platform on 23 September 2026. The controller named in connection with the platform is Fidias Panayiotou. The basis for the fine was the controller's failure to comply with a demand from the Commissioner to suspend processing, combined with a broader lack of cooperation with the authority over the course of its inquiry. The fine is reported directly through press coverage naming the Commissioner, though no primary Commissioner decision document has been located for this period, so detail beyond the headline figure and the stated grounds is not independently confirmed. This action sits within the standing structure of the GDPR's tiered maximum penalty regime, which applies in Cyprus without any national variation identified to date: a lower tier of up to EUR 10 million or 2% of global annual turnover, and a higher tier of up to EUR 20 million or 4%, depending on the nature of the infringement. The EUR 6,000 figure imposed on Agora's controller is far below either tier's ceiling, consistent with a penalty directed at procedural non-cooperation rather than at the gravity of an underlying large-scale processing violation. The Agora decision is the most recent confirmed enforcement data point for the Cyprus authority. It demonstrates that the Commissioner is prepared to act specifically on a controller's failure to cooperate with a suspension demand, independent of whatever separate assessment might eventually be made of the underlying personal-data practices that prompted the original inquiry. #### Outlook Whether the Commissioner pursues any further or larger penalty against Agora's controller in connection with the underlying processing conduct that triggered the suspension demand remains to be seen, as does whether a primary decision document will be published setting out that conduct in full. The EUR 6,000 figure, while modest against the GDPR's statutory ceilings, establishes a recent precedent for the authority's willingness to penalise non-cooperation as a discrete ground for action, which may be relevant to how other ongoing inquiries in Cyprus are handled going forward. Periodic update · new data 2026-10-11 #### Enforcement & Redress On 23 September 2026, Cyprus's Commissioner for Personal Data Protection imposed a EUR 6,000 administrative fine on the Agora app or platform, whose controller is Member of the European Parliament Fidias Panayiotou. The fine was imposed not for a substantive breach of data-protection principles but specifically for failing to respond fully, clearly and promptly to requests from the Commissioner's office. The controller has publicly stated an intention to contest the fine in court, meaning the matter is not yet finally resolved. The significance of this enforcement action lies in its procedural basis rather than its size. A fine for non-cooperation with regulatory information requests, as distinct from a fine for the underlying substantive conduct being investigated, demonstrates that the Commissioner treats a controller's responsiveness to the regulator's own investigatory process as an independently enforceable obligation. This matters because it removes any incentive a controller might otherwise have to stonewall or delay responding to regulatory inquiries in the hope that doing so might frustrate or slow a substantive investigation: non-cooperation itself now carries a demonstrated, dated enforcement consequence in Cyprus, separate from whatever the underlying inquiry might ultimately find. The fact that this action was taken against a controller associated with a sitting Member of the European Parliament is also notable from an institutional-independence perspective: it indicates the Commissioner was prepared to act in a matter carrying some degree of political visibility, rather than treating the controller's public profile as a reason for forbearance. That the controller intends to contest the fine in court is itself unremarkable procedurally, judicial review of administrative fines is a standard available remedy, but the outcome of that challenge will be informative as to how robust Cyprus's non-cooperation enforcement basis proves when tested. Separately, standing architecture here, this cycle's enforcement activity should be read against the structural fact that the Office of the Commissioner for Personal Data Protection operates under Law N.125(I)/2018, which in Section 32(3) empowers the Commissioner to impose fines of up to EUR 200,000 specifically for violations relating to non-profit activities, a national variance from the GDPR Article 83 turnover-based tiered fine structure. This existing national power is a reminder that Cyprus's fine architecture includes both the GDPR's general turnover-based framework and specific national fine caps for particular categories of violation, which is relevant background for understanding the comparatively modest EUR 6,000 figure in the Agora matter, that fine falling well within the Commissioner's broader discretionary enforcement range rather than representing any kind of cap or ceiling. #### Outlook The court challenge to the Agora fine, if and when it proceeds, will be a useful test of the durability of Cyprus's non-cooperation enforcement basis, though no timeline for that judicial process has been identified within this cycle's research. Given the Commissioner's demonstrated willingness to fine for non-cooperation independent of the underlying substantive matter, controllers in Cyprus should expect that regulatory information requests carry an independently enforceable obligation to respond fully, clearly and promptly, regardless of the eventual outcome of whatever substantive inquiry prompted the request. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 87 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) enforcement activity index Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties