Cyprus Law 125(I)/2018 and the GDPR

The regulator

The Commissioner for Personal Data Protection is Cyprus's supervisory authority. The Commissioner publishes an unofficial English translation of Law 125(I)/2018 (dataprotection.gov.cy).

Fines and offences

• Administrative fines follow GDPR Article 83 (Law 125(I)/2018, s.32(1)). Unpaid fines are recoverable as a civil debt owed to the Republic (s.32(2)).
• Fines on public authorities or bodies for non-profit activities may not exceed €200,000 (s.32(3)).
• Criminal offences (s.33) include failing to keep the Article 30 record of processing, failing to cooperate with the Commissioner, failing to notify a breach to the Commissioner or to data subjects, failing to carry out a required DPIA, and unlawful transfers to third countries (CyLaw, Part X).

Enforcement activity

In May 2024 the Commissioner reported that, over six years, the office had handled 2,585 complaints (746 about unsolicited advertising), carried out 506 audits and issued 299 decisions with total fines of €1.561 million (Cyprus Mail). Unsolicited marketing is the largest single complaint category, so marketing consent is worth getting right.

For GCC companies expanding to Cyprus

See our guide: Expanding to Cyprus or the EU: a GDPR primer for GCC companies.