CyprusGDPR Articles 33-34 and Law 125(I)/2018 Article 12, Breach Notification in Cyprus
Regulation (EU) 2016/679, Arts. 33-34; Law 125(I)/2018, Art. 12
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the ODPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Cyprus, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms, unless Law 125(I)/2018 Article 12 exempts you after an impact assessment and prior consultation with the Commissioner.
These lines are LexLint's reading of the law's text. Also read by: Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Office of the Commissioner for Personal Data Protection, Cyprus) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.gov.cy/dataprotection/plirofories-gia-organismoys/gnostopoiisi-paraviasis/
- Guidance body
- Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Office of the Commissioner for Personal Data Protection, Cyprus)
- Open questions
- Does Article 12 of Law 125(I)/2018 let a controller withhold from the person the communication of a breach under Article 34 of Regulation (EU) 2016/679 before the prior consultation with the Commissioner required by paragraph 2 has taken place?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 33(5) requires the controller to document every personal data breach, whether or not it is notified, covering the facts, its effects and the remedial action taken. Those three items are outside the closed list of log contents. The notification rules in Articles 33(1) to (4) and 34 are reports, not records. Article 12 of Law 125(I)/2018 lets a controller be exempted from telling the person, after an impact assessment and prior consultation with the Commissioner.
- Kind
- Explicit
- As of
- Provision
- Article 33(5) (the controller documents every personal data breach)
- Trigger
- security_incident
What this law does
A controller must notify the ODPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Cyprus, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Article 12 of Law 125(I)/2018 lets a controller be exempted, in whole or in part, from the duty to communicate a personal data breach to the person, for a purpose in Article 23(1) of the Regulation. That exemption requires an impact assessment and prior consultation with the Commissioner.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .