Operates a social platform, in Cyprus

Information Society Services and Electronic Commerce Law of 2004 (Ο Περί Ορισμένων Πτυχών των Υπηρεσιών της Κοινωνίας της Πληροφορίας και ειδικά του Ηλεκτρονικού Εμπορίου Νόμος του 2004), Law 156(I)/2004 as amended by 97(I)/2007, Articles 15 to 18 · Read the law's page

• To keep the hosting exemption, have no actual knowledge that the activity or the stored information is unlawful (and, for damages claims, no awareness of facts or circumstances from which it is apparent), or act expeditiously to remove the information or disable access to it as soon as you gain that knowledge or awareness.
• The hosting exemption does not apply where the recipient of your service acts under your authority or control.
• Tell the Competent Authority promptly of any suspicion of illegal information or activity by your service recipients that comes to your attention, and give the competent authorities, on request, information that helps identify the recipients with whom you have storage agreements.

Art. 35B of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 · Read the law's page

• Notify the Digital Security Authority without undue delay, and in any event within six (6) hours of becoming aware of a significant incident, with an early warning stating, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it may have a cross-border impact.
• Follow with an incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact, including any indicators of compromise where available.
• Submit an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every fifteen days counted from the incident notification until the final report, and a final report within fifteen days of restoring the affected network or information system's normal operation).
• Where you are a trust service provider, notify within 24 hours rather than 72 for a significant incident affecting the trust services you supply.
• Where applicable, notify without undue delay the recipients of your services who may be affected by a significant cyber threat, of any measures or corrective action they can take, and notify them of a significant incident likely to adversely affect their use of the service.
• This binds an essential or important entity established in Cyprus under Article 2A, sized at or above the medium-enterprise threshold of Commission Recommendation 2003/361/EC, or regardless of size for a category the Law names outright (a public electronic communications provider, a trust service provider, a TLD registry), across the sectors listed in Annexes I and II, which name an online marketplace, an online search engine and a cloud computing service among the digital providers they reach; the wider sector classes those Annexes also reach (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. The obligation runs to this jurisdiction's own row, which is a companion of this jurisdiction's risk-management and governance row.

Arts. 35 and 35A of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your activities or to provide your services, proportionate to the risk, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.
• Cover at least: risk-analysis and information-system security policies; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the security of your relationships with your direct suppliers and service providers; secure acquisition, development and maintenance of systems, including vulnerability handling and disclosure; policies to assess the effectiveness of these measures; basic cyber hygiene practices and cybersecurity training; cryptography and, where appropriate, encryption policies; human-resources security, access-control policies and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.
• Have your senior management approve these risk-management measures and oversee their implementation; senior management can be held accountable for the entity's breach of this duty, and must undergo, and offer staff, regular training so they can identify risks and assess cybersecurity risk-management practices.
• This binds an essential or important entity established in Cyprus under Article 2A, sized at or above the medium-enterprise threshold of Commission Recommendation 2003/361/EC, or regardless of size for a category the Law names outright (a public electronic communications provider, a trust service provider, a TLD registry), across the sectors listed in Annexes I and II, which name an online marketplace, an online search engine and a cloud computing service among the digital providers they reach; the wider sector classes those Annexes also reach (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity.

Digital Services Act Implementation Law of 2025 (Ο περί της Εφαρμογής του Κανονισμού (ΕΕ) 2022/2065, σχετικά με την Ενιαία Αγορά Ψηφιακών Υπηρεσιών, Νόμος του 2025), Law 122(I)/2025, Articles 4 to 14, 19 and 20 · Read the law's page

• If you provide intermediary services that fall within the Law (you are established in the Republic, have a legal representative there, have a substantial connection with it, or provide services in it), register in the Coordinator's Register of Intermediary Service Providers within three months of the Register starting to operate, or before you start providing intermediary services in the Republic, with the contact points, languages and legal representative details the Law lists.
• Tell the Coordinator of any change in your registered details immediately and no later than ten days after the change.
• When the Coordinator or a competent authority makes a specific reasoned request for information, supply it without delay, on the schedule and in the detail it sets.
• Comply with Regulation (EU) 2022/2065 in full, because an act or omission contrary to any of its provisions is an offence under the Law and the Coordinator or competent authority may impose a fine.
• Attend when the Coordinator summons you, and produce the documents, books, plans and records it requires, unless you have a reasonable cause.

Ο περί της Ευθύνης λόγω Ελαττωματικών Προϊόντων Νόμος του 2026 (Liability for Defective Products Bill) · Read the law's page

• This bill is not law: the consultation draft was posted on 25 February 2026, and it would apply to products made available on the market after 9 December 2026 (draft Articles 3(1) and 18(1)).
• If you develop, make or produce software, have it designed or made, or put your name or trade mark on it, you answer as its manufacturer; free and open-source software developed or supplied outside a commercial activity is outside the draft (draft Articles 2 and 3(2)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect from software, an update or upgrade, a missing safety update, a related service or a substantial modification is not excused on the ground that the defect arose after you placed the product on the market (draft Article 10(2)).
• Judge safety against all the circumstances, including cybersecurity requirements, any ability of the product to keep learning or acquire new features after it is placed on the market, and any recall (draft Article 6(2)).
• Keep documents you could produce: when a claimant shows facts and evidence supporting a plausible claim, the court can require you to disclose the documents in your possession or control, and failing to produce the relevant evidence presumes the product defective (draft Articles 8(1) and 9(2)(a)).
• Meet the mandatory safety requirements, national or EU, that protect against the harm suffered: a claimant who shows that a product does not meet them gets a presumption of defect (draft Article 9(2)(b)).
• If you are the importer, the authorized representative or the fulfilment service provider of a manufacturer established outside the EU, you answer in the manufacturer's place; a distributor, or an online platform that lets consumers conclude distance contracts with traders, answers too if it does not name an operator or its own supplier within one month of the request (draft Article 7(1)(c), (3) and (4)).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into service, you answer as its manufacturer (draft Article 7(2)).
• Do not rely on a contract term or national law to be released from liability to the injured person (draft Article 14).
• Be ready to prove an excuse: that you did not place the product on the market or put it into service, that the defect probably did not exist then or appeared afterwards, that it results from complying with legal requirements, that the objective state of scientific and technical knowledge did not allow it to be discovered, or the component and modification excuses (draft Article 10(1)).
• If you integrate a software component made by someone else into a product, you cannot sue the component's manufacturer where it was a micro or small enterprise when it placed the component on the market or you agreed by contract to waive that right (draft Article 11(2)).
• Keep the claim periods in view: three years from the day the injured person learned or could reasonably have learned of the damage, the defect and the liable operator; ten years from the day the defective product was placed on the market or put into service; 25 years where latent personal injury prevented a claim (draft Articles 15 and 16).