Cyprus. Comprehensive data protection. Act
Law 125(I)/2018Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data, Law 125(I)/2018
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Cyprus's Law 125(I)/2018 supplements the GDPR, confirms the Commissioner's powers and sets national derogations including for journalism, research and genetic/biometric data. It creates criminal offences for serious misuse.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 14. Lower fine ceiling for public authorities (€200,000, or €1m if commercial activity); processing of genetic/biometric data for health or life insurance prohibited; criminal penalties including imprisonment.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; public authorities capped at €200,000
§3Dates
- Key dates
- Adopted
- In force
- Repealed Law 138(I)/2001
§4Text and authority
- Text
- Authoritative text cylaw.org
- English text dataprotection.gov.cy
- Authority
- Commissioner for Personal Data Protection
§5Where it applies
- Domestic law of
- Cyprus
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.