CyprusIntellectual Property and Related Rights Law, Articles 49-50 (Non-Consensual Deepfake Imitation Ban)
In force since .
An AI prohibited practices rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not make available to the public an AI-generated deepfake imitation of a performer's performance without that performer's explicit consent.
- Do not make available to the public an AI-generated deepfake imitation of a natural person's physical likeness, voice, or biometric data without that person's explicit consent.
- An exception applies for an imitation that is satire or parody and, for a natural person's physical likeness, voice or biometric data, also for caricature and political or social commentary, unless the imitation constitutes disinformation posing a serious risk to the rights or essential interests of the affected person or others.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Knowingly breaching article 50 of the base Law (a natural person's personal physical characteristics, including voice and biometric data) is an offence under article 14(1)(στ), added by section 3 of Law 29(I)/2026. On conviction the penalty is a fine of up to EUR 80,000, imprisonment of up to 3 years, or both; on a second or later conviction, a fine of up to EUR 100,000, imprisonment of up to 4 years, or both. The offence is defined by reference to article 50 alone.
Who enforces it
Settledness
- As of
- Open questions
- Does 'διατίθενται στο κοινό' (made available to the public) in article 50(1) reach a deepfake sent in a private message or shared in a closed group?
- Does the disinformation proviso in article 50(2), 'παραπληροφόρηση' that 'ενδέχεται να επιφέρει σοβαρό κίνδυνο' (that may bring a serious risk), remove the exception for satire, parody and commentary whenever a viewer could take the imitation for genuine, or only when it creates a serious risk to someone's rights or essential interests?
What it makes you log
Logging duty
New articles 49 and 50 create a consent-based prohibition on making a deepfake imitation available to the public; unlike GDPR Article 7(1)'s express demonstrability duty, nothing in either article requires a person to demonstrate, prove, document or produce evidence of consent.
- Kind
- None
- As of
What this law does
Law 29(I)/2026 inserted new articles 49 and 50 into Cyprus's Intellectual Property and Related Rights Law, defining a deepfake product by reference to Article 3(60) of the EU AI Act. A deepfake imitation of a performer's performance, or of a natural person's personal physical characteristics including voice and biometric data, may not be made available to the public without that person's explicit consent.
For a performer's performance, the consent requirement does not apply to an imitation that is satire or parody, unless it amounts to disinformation posing a serious risk to the rights or essential interests of the affected person or others. For a natural person's personal physical characteristics, the consent requirement also does not apply to caricature or political or social commentary, with the same disinformation proviso.
The protection lasts until 50 years have passed from the year of death of the performer or the person depicted. It was published in the Official Gazette on . Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.
When LexLint raises it
When your app profile says your app generates audio with AI, generates images with AI, generates video with AI or processes biometric data.
Back to the example · Lint your app
Page updated .