CyprusGDPR Articles 12-21 and Law 125(I)/2018 Article 11, Data Subject Rights in Cyprus
Regulation (EU) 2016/679, Arts. 12-21; Law 125(I)/2018, Art. 11
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Cyprus within one month of receipt.NIST Privacy FrameworkCT.PO-P3
- Before you restrict, in whole or in part, a person's rights under General Data Protection Regulation (GDPR) Articles 12, 18, 19 or 20 in Cyprus on a ground in GDPR Article 23(1), carry out an impact assessment and consult the Commissioner, and tell the person about the restriction, under Law 125(I)/2018 Article 11.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Office of the Commissioner for Personal Data Protection (Cyprus) (guidance, recorded ); Case C-487/21 F.F. v Österreichische Datenschutzbehörde and CRIF, judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0487
- Guidance link
- https://www.gov.cy/dataprotection/plirofories-gia-organismoys/sychnes-erotiseis/
- Case citation
- Case C-487/21 F.F. v Österreichische Datenschutzbehörde and CRIF, judgment of the Court of Justice of (First Chamber)
- Guidance body
- Office of the Commissioner for Personal Data Protection (Cyprus)
- Open questions
- Does Article 11(1) of Law 125(I)/2018, which lets the controller itself apply measures restricting the rights in Articles 12, 18, 19 and 20 of Regulation (EU) 2016/679, meet the requirement of Article 23(1) of that Regulation that a restriction be laid down by a legislative measure?
What record it asks for
Logging duty
A controller that restricts the rights in Regulation Articles 12, 18, 19 and 20 must first carry out an impact assessment, which Article 11(3) says must include the information in Article 23(2) and Article 35(7) of the Regulation, and must consult the Commissioner. That assessment is the only document the row requires; there is no log or register, and the Article names no retention period. The rest of Articles 12 to 21 sets response periods only.
- Kind
- Implicit
- As of
- Provision
- Article 11(2) and (3) (an impact assessment, with stated contents, before a controller restricts data-subject rights)
- Trigger
- personal_data_processing
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Cyprus can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. Article 11 of Law 125(I)/2018 lets a controller restrict, in whole or in part, the rights in GDPR Articles 12, 18, 19 and 20 on a ground in Article 23(1) of the Regulation.
Before doing so it must carry out an impact assessment and consult the Commissioner. The controller must tell the person about the restriction.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .