CyprusGDPR Articles 82-83 and ODPC Enforcement in Cyprus
Regulation (EU) 2016/679, Arts. 82-83
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Expect the ODPC to have jurisdiction and fining power over your processing of personal data of a person in Cyprus, up to the General Data Protection Regulation (GDPR) Article 83 tiers.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under GDPR Article 82.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Law 125(I)/2018 Article 33 creates criminal offences layered on top of the Commissioner's administrative fine, covering a controller's or processor's failure to keep or update a record of processing activities or to cooperate with the Commissioner, failure to notify a personal data breach to the Commissioner or the data subject, failure to carry out a data protection impact assessment, obstructing a data protection officer, an unlawful third-country transfer, unauthorised interference with a personal data filing system (whether or not for profit), and obstructing the Commissioner's Article 58 GDPR powers. A person convicted of any of these offences (Article 33(1)(a) to (ib)) is liable to imprisonment not exceeding three years or a fine not exceeding EUR 30,000, or both. Two narrower offences (general non-compliance not otherwise criminalised by this article, and a public authority's unlawful large-scale combination of filing systems) carry a lesser maximum of one year's imprisonment or a EUR 10,000 fine, or both.
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier the Commissioner applies, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets the narrower EUR 10,000,000 or 2 percent tier for the Article 25 to 39 obligations. Law 125(I)/2018 Article 32 gives the Commissioner the power to impose this fine and lets an unpaid fine be recovered as a civil debt owed to the Republic, and sets one national derogation: a fine imposed on a public authority or public body in respect of non-profit-making activities may not exceed EUR 200,000, regardless of what the GDPR ceiling would otherwise allow.
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Commissioner for Personal Data Protection (Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Cyprus's supervisory authority under the GDPR and Law 125(I)/2018.
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Office of the Commissioner for Personal Data Protection (ODPC) is the supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. Law 125(I)/2018 Article 32(3) narrows the ceiling only for a public authority or public body's non-profit-making activities, to EUR 200,000; no narrower Cyprus-specific ceiling applies to a private-sector controller or processor, and no dedicated collective-redress statute is identified.
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisionsprocesses_biometricsprocesses_voice
Read the law
Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.