Handles health records, in Cyprus

Art. 35B of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 · Read the law's page

• Notify the Digital Security Authority without undue delay, and in any event within six (6) hours of becoming aware of a significant incident, with an early warning stating, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it may have a cross-border impact.
• Follow with an incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact, including any indicators of compromise where available.
• Submit an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every fifteen days counted from the incident notification until the final report, and a final report within fifteen days of restoring the affected network or information system's normal operation).
• Where you are a trust service provider, notify within 24 hours rather than 72 for a significant incident affecting the trust services you supply.
• Where applicable, notify without undue delay the recipients of your services who may be affected by a significant cyber threat, of any measures or corrective action they can take, and notify them of a significant incident likely to adversely affect their use of the service.
• This binds an essential or important entity established in Cyprus under Article 2A, sized at or above the medium-enterprise threshold of Commission Recommendation 2003/361/EC, or regardless of size for a category the Law names outright (a public electronic communications provider, a trust service provider, a TLD registry), across the sectors listed in Annexes I and II, which name an online marketplace, an online search engine and a cloud computing service among the digital providers they reach; the wider sector classes those Annexes also reach (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. The obligation runs to this jurisdiction's own row, which is a companion of this jurisdiction's risk-management and governance row.

Arts. 35 and 35A of the Security of Networks and Information Systems Law of 2020, N. 89(I)/2020, as amended by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your activities or to provide your services, proportionate to the risk, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.
• Cover at least: risk-analysis and information-system security policies; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the security of your relationships with your direct suppliers and service providers; secure acquisition, development and maintenance of systems, including vulnerability handling and disclosure; policies to assess the effectiveness of these measures; basic cyber hygiene practices and cybersecurity training; cryptography and, where appropriate, encryption policies; human-resources security, access-control policies and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.
• Have your senior management approve these risk-management measures and oversee their implementation; senior management can be held accountable for the entity's breach of this duty, and must undergo, and offer staff, regular training so they can identify risks and assess cybersecurity risk-management practices.
• This binds an essential or important entity established in Cyprus under Article 2A, sized at or above the medium-enterprise threshold of Commission Recommendation 2003/361/EC, or regardless of size for a category the Law names outright (a public electronic communications provider, a trust service provider, a TLD registry), across the sectors listed in Annexes I and II, which name an online marketplace, an online search engine and a cloud computing service among the digital providers they reach; the wider sector classes those Annexes also reach (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity.

Law 59(I)/2019 (Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019), Arts. 26-27, 32-35 · Read the law's page

• If you provide health services in Cyprus, create a Provider Bank within the period the National eHealth Authority sets (Law 59(I)/2019 Article 26).
• Keep backup copies of the health data in your Provider Bank and log any recovery of data from backups, so that the nature and extent of any data loss can be assessed (Article 27, paragraph 1, point (d)).
• Keep the health data in the Provider Bank fully confidential, and have your authorized employees do the same (Article 27, paragraph 3).
• Log every access to the Electronic Health Record with at least the date and time, a unique transaction number, the type of processing, the unique identifier of the person accessing, the identifier of the data used, the search criteria and any error messages (Article 32).
• Do not access an Electronic Health Record without the citizen's consent (Article 34).