Cyprus GDPR Enforcement + Recent Fines 2026 — DPC Decisions, Sanctions, Lessons Learned

1. The GDPR Article 83 fine framework

• Lower tier (Article 83(4)): up to €10M or 2% global annual turnover — for breaches of Article 8 (child consent), Article 11 (processor records), Article 25-39 (controller / processor obligations), Article 42-43 (certification body / accreditation).
• Higher tier (Article 83(5)): up to €20M or 4% global annual turnover — for breaches of Articles 5-7 + 9 (basic processing principles + lawful basis + consent + special categories), Articles 12-22 (data subject rights), Articles 44-49 (cross-border transfers), Article 58(2) (non-compliance with orders).

2. Notable Cyprus DPC enforcement themes

• Direct-marketing breaches — failure to obtain valid consent for marketing emails / SMS.
• Employee monitoring — disproportionate surveillance, CCTV in workplaces, BYOD policies.
• Hotel guest data — security breaches, unauthorised access, retention beyond purpose.
• Financial-services data — KYC over-collection, inadequate security.
• Children's data — schools, online services targeting minors without proper consent.
• Cross-border transfers — inadequate transfer mechanisms post-Schrems II.
• Subject-access-request handling — failure to respond within 1-month deadline.

3. Common enforcement patterns

• Complaints triggered — most enforcement starts with a data-subject complaint to Cyprus DPC.
• Sector-led investigations — DPC periodically focuses on a sector (recent: financial services, healthcare).
• Cross-border cases — Cyprus DPC cooperates with other EU DPAs under GDPR one-stop-shop mechanism.
• Press / publicity triggers — high-profile data leaks attract DPC attention immediately.
• Investigation duration — typically 6-18 months from complaint to final decision.

4. Sanctions scale in practice

Indicative Cyprus DPC fines (anonymised composites based on published decisions):

• Direct-marketing breach by SME (under 50 employees): €5,000-€20,000.
• Employee monitoring breach by mid-size company: €25,000-€80,000.
• Cross-border-transfer breach by tech company: €80,000-€250,000.
• Major data leak with personal-data exposure: €250,000-€1M+.
• Wilful repeated non-compliance: tier-2 maximums applied.

5. What triggers DPC investigation

• Customer / employee complaint — most common trigger.
• Press / social-media reports of data leak.
• Self-reporting under 72-hour breach-notification rule.
• DPC-initiated thematic review (sector-focused).
• Cross-border DPA cooperation under one-stop-shop.
• Court referral from related civil litigation.

6. Compliance lessons learned

1. 1Implement valid consent mechanisms — record + retain consent metadata.
2. 2Honour data-subject rights within statutory deadlines (1 month standard).
3. 3Robust security — encryption, access controls, regular pen-testing.
4. 4Vendor due diligence — DPAs in place + verified.
5. 5Cross-border transfer mechanisms — current SCCs + assessment.
6. 6Employee training — annual GDPR awareness.
7. 7Breach response plan — tested + 72-hour timeline.
8. 8Document everything — RoPA, DPIAs, decisions, complaint handling.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.