Cyprus. ePrivacy / marketing. Act

Law 112(I)/2004Regulation of Electronic Communications and Postal Services Law, Law 112(I)/2004

In force

Partly verified

Low confidence. Cyprus may have recast its electronic communications law when transposing the EECC (2022); not verified.

§1Summary

Synopsis

Law 112(I)/2004 implements the ePrivacy Directive in Cyprus, including consent for cookies and opt-in for unsolicited electronic communications.

Key themes

cookies/terminal equipment consent
direct marketing
soft opt-in
traffic and location data

Unique features

The Commissioner enforces the cookie and spam provisions directly.

SaaS relevance

Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.

§2Obligations

Extraterritorial: Yes
Breach notification: Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
DPO: No
Cross-border transfers: None
Maximum penalty: Administrative fines under Law 112(I)/2004; GDPR fines

§3Dates

Key dates

Adopted 30 April 2004
In force 1 May 2004
Cookie rule (Art 99) amended 2012 for ePrivacy 2009

§4Text and authority

Text

Authoritative text cylaw.org

Authority

Commissioner for Personal Data Protection (cookies/spam); OCECPR (telecom)

§5Where it applies

Domestic law of: Cyprus

§6Sources and verification

Sources consulted

edpb.europa.eu

Verification

Low confidence.

Partly verified

Low confidence. Cyprus may have recast its electronic communications law when transposing the EECC (2022); not verified.