Data Protection Update in Cyprus: Q3 2026

Cyprus data protection 2026 has entered a more active enforcement phase. The Office of the Commissioner for Personal Data Protection - Cyprus';s primary supervisory authority under the General Data Protection Regulation - has sharpened its investigative focus, issued new guidance, and concluded several notable cases that affect businesses operating on the island. This guide covers the key regulatory developments, enforcement decisions, practical compliance obligations, and strategic steps that international businesses and local operators should take in response.

The legal framework for data protection in Cyprus rests on the GDPR as directly applicable EU law, supplemented by the Processing of Personal Data (Protection of Individuals) Law of 2018 (Law 125(I)/2018). This domestic legislation designates the Commissioner for Personal Data Protection as the competent supervisory authority, sets out procedural rules for complaints and investigations, and provides for administrative fines aligned with GDPR thresholds.

Recent months have brought several notable regulatory shifts. The Commissioner';s office has published updated guidance on the use of cookies and tracking technologies, aligning Cyprus';s position more closely with the approach taken by other EU data protection authorities following the European Data Protection Board';s harmonised framework. The guidance clarifies that consent obtained through pre-ticked boxes or bundled consent mechanisms does not meet the GDPR standard of freely given, specific, informed and unambiguous consent.

A further development concerns the processing of biometric data in employment contexts. The Commissioner has signalled that employers using biometric time-and-attendance systems must satisfy the conditions under Article 9 GDPR for processing special category data, and that reliance on employee consent alone is generally insufficient given the inherent power imbalance in employment relationships. Employers should review their legal basis and implement appropriate safeguards.

The Commissioner has also updated its register of approved standard contractual clauses for international data transfers, reflecting the European Commission';s modernised SCCs. Businesses transferring personal data outside the European Economic Area - a common scenario for Cyprus-based holding companies and financial services firms with global operations - must ensure their transfer mechanisms are current and that transfer impact assessments have been completed where required.

Enforcement activity in Cyprus has increased in both volume and severity. The Commissioner has concluded investigations resulting in formal reprimands, corrective orders and financial penalties across several sectors, including financial services, hospitality and e-commerce.

One significant category of cases involves inadequate data breach notification. Under Article 33 GDPR, controllers must notify the Commissioner of a personal data breach within 72 hours of becoming aware of it, where the breach is likely to result in a risk to individuals'; rights and freedoms. Several businesses were found to have delayed notification by days or weeks, citing internal investigation procedures. The Commissioner has made clear that the 72-hour clock starts from the moment the controller has reasonable grounds to believe a breach has occurred, not from the conclusion of a full internal review.

A second enforcement theme concerns data subject rights. Businesses operating customer-facing platforms have faced complaints for failing to respond to access requests within the one-month period prescribed by Article 12 GDPR, and for providing incomplete or evasive responses. The Commissioner';s decisions in these cases emphasise that responses must be substantive, intelligible and provided free of charge as a default.

A third area of enforcement relates to data retention. Several organisations were found to be retaining personal data well beyond the periods justified by their stated purposes, without a documented retention schedule. The Commissioner has ordered deletion of excess data and required the adoption of formal retention policies. In practice, many businesses in Cyprus - particularly smaller operators and family-owned enterprises - have historically treated data retention as an administrative afterthought. This is no longer a viable approach.

For businesses that receive a formal complaint or investigation notice from the Commissioner, the procedural rules under Law 125(I)/2018 allow for written submissions and, in some cases, oral hearings before a final decision is issued. Engaging legal counsel at the earliest stage of an investigation materially improves the outcome in most cases. If your business has received a Commissioner inquiry or is reviewing its compliance posture, contact info@vlolawfirm.com - we can assist with documents, filings and regulatory correspondence.

Cyprus occupies a distinctive position in international business structuring. Many multinational groups use Cyprus holding companies, intellectual property holding vehicles or regional headquarters, which routinely transfer personal data - including employee data, customer records and financial information - across borders. The data protection implications of these structures deserve careful attention.

The adequacy decision framework under Article 45 GDPR provides a simplified transfer mechanism for transfers to countries the European Commission has recognised as providing an equivalent level of protection. For transfers to countries without an adequacy decision, businesses must rely on appropriate safeguards such as standard contractual clauses, binding corporate rules or derogations under Article 49 GDPR.

A common mistake made by Cyprus-based holding companies is to assume that intra-group data flows are automatically permissible because the entities involved are related. GDPR does not recognise corporate group membership as a legal basis for data transfers. Each transfer must be justified by a lawful basis, and cross-border transfers must be covered by an appropriate transfer mechanism. Binding corporate rules offer a comprehensive solution for groups with frequent intra-group transfers, but they require approval from a lead supervisory authority and involve a significant implementation effort.

Transfer impact assessments - sometimes called TIAs - have become a standard requirement following the Schrems II judgment of the Court of Justice of the European Union. A TIA requires the exporting entity to assess whether the legal framework of the destination country provides effective protection equivalent to EU standards, and to implement supplementary measures where gaps are identified. Many Cyprus businesses have completed TIAs for their primary transfer destinations but have overlooked secondary transfers arising from the use of cloud service providers and SaaS platforms. These indirect transfers carry the same legal risk as direct transfers.

Practical scenario one: a Cyprus-based fintech company processes customer KYC data on behalf of a parent entity in a non-EEA country. The company must identify whether it acts as a controller or processor, execute appropriate data processing agreements, complete a TIA for the destination country, and ensure that the parent entity';s privacy notice covers the transfer. Failure to do so exposes both entities to regulatory action in Cyprus and potentially in the parent';s home jurisdiction.

Practical scenario two: a Cyprus holding company employs staff locally and shares HR data - payroll, performance records, health information - with a group HR platform hosted outside the EEA. The company must map the data flows, identify the legal basis for processing special category data where health information is involved, execute SCCs with the platform provider, and complete a TIA. The Commissioner has indicated that HR data transfers are a priority area for review.

Businesses established in Cyprus, or those targeting Cyprus-based individuals, must maintain a comprehensive compliance programme. The core obligations under GDPR and Law 125(I)/2018 are well established, but recent guidance and enforcement decisions have clarified several points that merit specific attention.

Records of processing activities. Article 30 GDPR requires controllers and processors with 250 or more employees, or those processing data that is likely to result in a risk to individuals'; rights and freedoms, to maintain a written record of processing activities. In practice, the Commissioner expects all businesses of meaningful size to maintain such records, regardless of headcount. The records must be kept up to date and made available to the Commissioner on request.

Data protection officers. Certain categories of controller and processor are required to appoint a data protection officer under Article 37 GDPR. These include public authorities, organisations carrying out large-scale systematic monitoring of individuals, and those processing special category data on a large scale. Financial services firms, healthcare providers and technology companies in Cyprus frequently fall within these categories. The DPO must be registered with the Commissioner';s office, and the registration must be kept current.

Privacy notices. The transparency obligations under Articles 13 and 14 GDPR require controllers to provide clear, accessible information about how personal data is used. A common mistake is to publish a generic privacy notice copied from a template without tailoring it to the actual processing activities of the business. The Commissioner has criticised notices that are vague about retention periods, fail to identify the legal basis for each processing purpose, or omit information about data subject rights.

Data protection impact assessments. Article 35 GDPR requires a DPIA before undertaking processing that is likely to result in a high risk to individuals. The Commissioner has published a list of processing operations for which a DPIA is mandatory in Cyprus. This list includes large-scale processing of special category data, systematic monitoring of publicly accessible areas, and processing involving automated decision-making with significant effects on individuals. Many businesses underestimate the scope of this obligation, particularly in relation to employee monitoring and profiling activities.

Processor agreements. Where a controller engages a third-party processor - a cloud provider, payroll bureau, marketing platform or IT service provider - a written data processing agreement meeting the requirements of Article 28 GDPR is mandatory. The agreement must specify the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. Many businesses in Cyprus have legacy service contracts that predate GDPR and have never been updated to include the required Article 28 provisions.

The Commissioner has issued or updated sector-specific guidance in several areas that are particularly relevant to the Cyprus business environment.

Financial services and AML intersections. Cyprus hosts a significant financial services sector, including investment firms, fund managers, payment institutions and insurance companies regulated by the Cyprus Securities and Exchange Commission and the Central Bank of Cyprus. These entities process large volumes of personal data in connection with anti-money laundering and know-your-customer obligations. The Commissioner has clarified that AML processing must be limited to what is strictly necessary for compliance purposes, and that data collected for AML purposes must not be repurposed for commercial profiling without a separate legal basis.

Tourism and hospitality. Cyprus';s hospitality sector collects personal data from guests across multiple touchpoints - reservations, loyalty programmes, CCTV, Wi-Fi access and payment processing. The Commissioner has noted that many hotels and resorts lack adequate data processing agreements with their technology vendors, and that CCTV retention periods frequently exceed what is proportionate. Hospitality operators should audit their data flows and ensure that CCTV footage is deleted within a documented and proportionate retention period.

Remote work and employee monitoring. The growth of remote and hybrid working arrangements has prompted questions about the lawfulness of employee monitoring tools, including screen capture software, keystroke logging and productivity tracking platforms. The Commissioner';s position, consistent with guidance from the European Data Protection Board, is that covert monitoring of employees is generally unlawful, and that overt monitoring must be proportionate, necessary and supported by a lawful basis. Employers must inform employees clearly about any monitoring in place.

Artificial intelligence and automated decision-making. The increasing use of AI-driven tools in hiring, credit scoring, fraud detection and customer segmentation raises specific obligations under Article 22 GDPR, which restricts solely automated decisions that produce legal or similarly significant effects on individuals. Businesses deploying such tools in Cyprus must ensure that human review is available, that individuals can contest decisions, and that the logic of automated processing is explained in accessible terms.

If your business operates in any of these sectors and is assessing its current compliance position, contact info@vlolawfirm.com - we can help structure the review and address gaps before they attract regulatory attention.

What are the most significant practical risks for businesses that have not updated their data protection compliance since GDPR came into force?

The primary risks are enforcement action by the Commissioner, including fines that can reach up to four percent of global annual turnover for the most serious infringements, and civil liability to data subjects for material or non-material damage caused by non-compliance. In practice, the Commissioner';s investigations are frequently triggered by individual complaints, which means that any dissatisfied customer, employee or business partner can initiate a formal inquiry. Businesses that have not reviewed their privacy notices, data processing agreements, retention schedules and transfer mechanisms since the original GDPR implementation are likely to have accumulated multiple compliance gaps. The cost of remediation is almost always lower than the cost of responding to an active investigation.

How long does a Commissioner investigation typically take, and what does it cost to respond?

The duration of a Commissioner investigation varies considerably depending on complexity. Straightforward complaint-based investigations may be resolved within a few months, while complex cases involving multiple data flows, international transfers or systemic failures can take considerably longer. Businesses subject to investigation should budget for legal counsel to prepare written submissions, gather evidence and, where appropriate, engage in dialogue with the Commissioner';s office. Professional fees for responding to an investigation typically start from the low thousands of EUR for straightforward matters and increase significantly for complex cases. Proactive compliance investment before an investigation is initiated is materially more cost-effective.

Should a Cyprus-based business appoint a data protection officer even if it is not legally required to do so?

Many businesses that fall below the mandatory DPO threshold nonetheless benefit from appointing one, either as a dedicated internal role or through an external DPO service. A DPO provides structured oversight of compliance obligations, serves as the point of contact for data subjects and the Commissioner, and helps embed a culture of data protection accountability across the organisation. For smaller businesses, an external DPO arrangement - where a qualified professional provides the function on a part-time or retainer basis - offers a cost-effective alternative to a full-time hire. The Commissioner looks favourably on businesses that have voluntarily appointed a DPO and can demonstrate active engagement with their compliance obligations.

Cyprus data protection compliance has moved from a box-ticking exercise to a substantive regulatory obligation with real enforcement consequences. Businesses operating in Cyprus - whether locally incorporated or targeting Cyprus-based individuals - must maintain current, documented compliance programmes that address the full range of GDPR and Law 125(I)/2018 requirements. The Commissioner';s recent enforcement activity signals that gaps in breach notification, data subject rights handling, retention practices and transfer mechanisms will attract scrutiny.

VLO Law Firms advises international clients on data protection matters in Cyprus. We can assist with compliance audits, DPO services, data processing agreements, transfer impact assessments, regulatory correspondence and Commissioner investigations. To request a consultation, contact: info@vlolawfirm.com