Makes education decisions, in Cyprus

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Law 125(I)/2018, Art. 31 · Read the law's page

• Where a decision based solely on automated processing about a person in Cyprus rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• Do not use personal data you process for archiving in the public interest, scientific or historical research, or statistics to take a decision that produces legal effects for a person in Cyprus or similarly significantly affects them, under Law 125(I)/2018 Article 31.
• Do not subject a person in Cyprus to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Cyprus on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Cyprus of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Cyprus as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, except within narrow exceptions the law allows.when it serves a public body
• Do not place on the market, put into service, or use an AI system that exploits individuals' vulnerabilities.
• Tell users, before or at the start of an interaction, that they are communicating with an AI system.
• Mark generated image, video, audio and text output in machine-readable form that identifies it as artificially generated.

Ο περί της Ευθύνης λόγω Ελαττωματικών Προϊόντων Νόμος του 2026 (Liability for Defective Products Bill) · Read the law's page

• This bill is not law: the consultation draft was posted on 25 February 2026, and it would apply to products made available on the market after 9 December 2026 (draft Articles 3(1) and 18(1)).
• If you develop, make or produce software, have it designed or made, or put your name or trade mark on it, you answer as its manufacturer; free and open-source software developed or supplied outside a commercial activity is outside the draft (draft Articles 2 and 3(2)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect from software, an update or upgrade, a missing safety update, a related service or a substantial modification is not excused on the ground that the defect arose after you placed the product on the market (draft Article 10(2)).
• Judge safety against all the circumstances, including cybersecurity requirements, any ability of the product to keep learning or acquire new features after it is placed on the market, and any recall (draft Article 6(2)).
• Keep documents you could produce: when a claimant shows facts and evidence supporting a plausible claim, the court can require you to disclose the documents in your possession or control, and failing to produce the relevant evidence presumes the product defective (draft Articles 8(1) and 9(2)(a)).
• Meet the mandatory safety requirements, national or EU, that protect against the harm suffered: a claimant who shows that a product does not meet them gets a presumption of defect (draft Article 9(2)(b)).
• If you are the importer, the authorized representative or the fulfilment service provider of a manufacturer established outside the EU, you answer in the manufacturer's place; a distributor, or an online platform that lets consumers conclude distance contracts with traders, answers too if it does not name an operator or its own supplier within one month of the request (draft Article 7(1)(c), (3) and (4)).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into service, you answer as its manufacturer (draft Article 7(2)).
• Do not rely on a contract term or national law to be released from liability to the injured person (draft Article 14).
• Be ready to prove an excuse: that you did not place the product on the market or put it into service, that the defect probably did not exist then or appeared afterwards, that it results from complying with legal requirements, that the objective state of scientific and technical knowledge did not allow it to be discovered, or the component and modification excuses (draft Article 10(1)).
• If you integrate a software component made by someone else into a product, you cannot sue the component's manufacturer where it was a micro or small enterprise when it placed the component on the market or you agreed by contract to waive that right (draft Article 11(2)).
• Keep the claim periods in view: three years from the day the injured person learned or could reasonably have learned of the damage, the defect and the liable operator; ten years from the day the defective product was placed on the market or put into service; 25 years where latent personal injury prevented a claim (draft Articles 15 and 16).