CyprusLaw 125(I)/2018, Cyprus GDPR Supplement
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Cyprus, including data collected by crawling.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 10(2) of Law 125(I)/2018 require an impact assessment and prior consultation with the Commissioner for every combination of large-scale filing systems of public authorities that uses an identity card number or another general identifier?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 33(1)(a) makes it an offense for a controller or processor not to keep the record of processing activities that Article 30 of the Regulation requires, not to update it, or to refuse to put it at the Commissioner's disposal on request. The Law does not restate what the record must contain; that is Article 30(1) of the Regulation.
- Kind
- Explicit
- As of
- Provision
- Article 33(1)(a) (it is an offense not to keep or update the Article 30 record of processing, or to refuse to produce it to the Commissioner on request)
- Trigger
- personal_data_processing
What this law does
Cyprus's private-sector regime is the General Data Protection Regulation (GDPR) plus Law 125(I)/2018 (The Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data Law of 2018), published in the Official Gazette of the Republic of Cyprus on , supplying domestic derogations and procedural rules. The Commissioner for Personal Data Protection, supported by the Office of the Commissioner (ODPC), is the supervisory authority.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .