Cyprus GDPR Compliance 2026 — Cyprus DPA, DPO Requirements, Fine Schedule, Enforcement

1. Cyprus's national framework

Cyprus Personal Data (Processing) Law 125(I)/2018 transposed national supplements to EU GDPR. Key Cyprus-specific provisions:

• Sector-specific derogations (financial services, employment, healthcare, marketing).
• Cyprus Data Protection Commissioner (DPC) enforcement powers + procedure.
• Criminal liability for wilful breaches (up to 5 years' imprisonment in egregious cases).
• Sectoral codes of conduct + certification frameworks.
• Cross-border-transfer-specific approvals.

2. DPO appointment requirements

Cyprus follows GDPR Article 37 thresholds — DPO required where:

• Processing is by a public authority (always DPO required).
• Core activities consist of systematic monitoring of data subjects at large scale.
• Core activities involve large-scale processing of special-category data.
• Sector codes apply (financial services + healthcare commonly require DPO).
• Cyprus DPC published guidance on 'large scale' interpretation — context-specific.

3. Key operational obligations

• Lawful basis identification for each processing activity.
• Privacy notices + policies in plain language.
• Data subject rights handling (access, rectification, erasure, portability, objection).
• Records of processing activities (Article 30 GDPR — formal register).
• Data Protection Impact Assessment (DPIA) for high-risk processing.
• Breach notification — DPC within 72 hours; data subjects without undue delay if high risk.
• Cross-border transfer mechanisms — SCCs / BCRs / adequacy decisions.

4. Cyprus DPC enforcement

Cyprus DPC actively enforces — issues guidance, conducts investigations, imposes fines. Cyprus-specific cases over recent years include sanctions on hotels, telecoms, financial-services firms, and tech companies.

• Fines up to €20M or 4% global turnover for serious breaches (higher tier).
• Fines up to €10M or 2% global turnover for less-serious breaches.
• Reprimand + corrective orders as escalation steps.
• Personal-accountability inquiries against directors / DPO for management failures.
• Publication of enforcement decisions (typically anonymised where appropriate).

5. Sector-specific Cyprus considerations

• Financial services (CySEC-supervised firms) — DPC + CySEC dual oversight.
• Healthcare (Cyprus GeSY-related processing) — sectoral codes.
• Marketing (direct mail, electronic communications) — Cyprus Electronic Communications Law overlaps.
• Crypto / fintech (MiCA CASPs) — DAC8 + GDPR + AMLD6 intersection.
• Employment + HR — Cyprus DPC published employer-specific guidance.

6. Compliance practical checklist

1. 1Record of processing activities (RoPA) — Article 30 GDPR register.
2. 2Privacy notices on website + customer onboarding.
3. 3Data subject rights handling procedure.
4. 4Vendor + processor due diligence + Data Processing Agreements (DPAs).
5. 5Cross-border transfer mechanisms documented (SCCs, BCRs, adequacy).
6. 6DPIA for high-risk processing.
7. 7Breach response plan + 72-hour DPC notification procedure.
8. 8Annual GDPR training for staff.
9. 9DPO appointment (where required) + DPO contact published.
10. 10ICO incident-log maintained.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.