Cyprus

Law 29(I)/2026 inserted new articles 49 and 50 into Cyprus's Intellectual Property and Related Rights Law, defining a deepfake product by reference to Article 3(60) of the EU AI Act. A deepfake imitation of a performer's performance, or of a natural person's personal physical characteristics including voice and biometric data, may not be made available to the public without that person's explicit consent.

For a performer's performance, the consent requirement does not apply to an imitation that is satire or parody, unless it amounts to disinformation posing a serious risk to the rights or essential interests of the affected person or others. For a natural person's personal physical characteristics, the consent requirement also does not apply to caricature or political or social commentary, with the same disinformation proviso.

The protection lasts until 50 years have passed from the year of death of the performer or the person depicted. It was published in the Official Gazette on 23 March 2026. Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.

Law 59(I)/2025 amended the Law of 2014 to replace the term child pornography with child sexual abuse material in its titles and offences. The preamble to Law 59(I)/2025 gives the rapid development of artificial intelligence, which has led to the production of child sexual abuse material through artificial intelligence applications and tools, as a reason for the amendment.

Article 2 defines child sexual abuse material as material produced by any means and medium, including material showing a child in a real or simulated sexual act, material showing a person who appears to be a child in such an act, and realistic images, reproductions or representations of a child in a sexual act. Article 8(5) makes it a felony to produce child sexual abuse material, punishable by imprisonment of up to 20 years.

Article 8(3) and (4) make it a felony, punishable by imprisonment of up to 15 years, to distribute, disseminate, transmit, offer, provide or make available such material, or to give information on how to obtain it. Article 8(1) and (2) make it a felony, punishable by imprisonment of up to 10 years, to acquire or possess such material, or to knowingly gain access to it through information and communications technology.

Article 8(6) provides imprisonment for life where the child shown in the material is under 13. Law 59(I)/2025 was published in the Official Gazette on 25 April 2025. Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Section 9(1) of Law 125(I)/2018 prohibits the processing of genetic and biometric data for health and life insurance purposes. Under section 9(2), where that processing rests on the data subject's consent, the further processing of the data requires a separate consent from the data subject. The Law's definition of biometric data in section 2(1) gives facial images and fingerprint data as its examples.

A controller must notify the ODPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Cyprus, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Article 12 of Law 125(I)/2018 lets a controller be exempted, in whole or in part, from the duty to communicate a personal data breach to the person, for a purpose in Article 23(1) of the Regulation. That exemption requires an impact assessment and prior consultation with the Commissioner.

Cyprus's private-sector regime is the General Data Protection Regulation (GDPR) plus Law 125(I)/2018 (The Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data Law of 2018), published in the Official Gazette of the Republic of Cyprus on 31 July 2018, supplying domestic derogations and procedural rules. The Commissioner for Personal Data Protection, supported by the Office of the Commissioner (ODPC), is the supervisory authority.

Transferring personal data of a person in Cyprus outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Under Article 17 of Law 125(I)/2018, a controller or processor that intends to transfer special categories of personal data to a third country on Article 46 safeguards or binding corporate rules must first inform the Commissioner.

The Commissioner may impose explicit restrictions on such a transfer for serious reasons of public interest. Under Article 18, a transfer of special categories that relies on an Article 49 derogation requires an impact assessment and prior consultation with the Commissioner.

General Data Protection Regulation (GDPR) Article 22 gives a person in Cyprus the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Article 31 of Law 125(I)/2018 adds that personal data processed for archiving in the public interest, scientific or historical research or statistics may not be used to take a decision that produces legal effects for the person or similarly significantly affects them.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Cyprus can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. Article 11 of Law 125(I)/2018 lets a controller restrict, in whole or in part, the rights in GDPR Articles 12, 18, 19 and 20 on a ground in Article 23(1) of the Regulation.

Before doing so it must carry out an impact assessment and consult the Commissioner. The controller must tell the person about the restriction.

The Office of the Commissioner for Personal Data Protection (ODPC) is the supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. Law 125(I)/2018 Article 32(3) narrows the ceiling only for a public authority or public body's non-profit-making activities, to EUR 200,000; no narrower Cyprus-specific ceiling applies to a private-sector controller or processor. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Within a period set by the National eHealth Authority, every health service provider must create a Provider Bank. The Provider Bank must keep backup copies of the health data, and any recovery of data from backups must be logged so that the nature and extent of any data loss can be assessed. The provider and its authorized employees must keep the health data in the Provider Bank fully confidential.

Any access to the Electronic Health Record must be logged, and each log entry must contain at least the date and time of access, a unique transaction number, the type of processing, the unique identifier of the person accessing, the identifier of the data used, the search criteria and any error messages. A person who violates the Law, or who gains access to an Electronic Health Record without the citizen's consent, is subject to an administrative fine imposed by the Authority.

Articles 1 to 16, 37 and 39 of the Law came into force on 10 July 2019 by a notice of the Council of Ministers under Article 39. Article 17 came into force on 15 October 2019 by a further notice of the Council of Ministers. No notice appointing the day the Articles this entry describes come into force has been located.

The Attacks against Information Systems Law of 2015, transposing EU Directive 2013/40/EU, punishes intentional access without right to the whole or part of an information system where that access is obtained by violating a security measure, by up to five years' imprisonment or a forty thousand euro fine or both (art. 3).

The same maximum penalty punishes intentionally and without right seriously hindering or interrupting an information system's operation by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing its electronic data, or by blocking access to that data (art. 4).

The same maximum penalty also punishes producing, selling, procuring for use, importing, distributing or otherwise making available a computer program, password, access code or similar tool intended to be used to commit an article 3 to 6 offence (art. 7). A legal person is guilty of an article 3 to 9 offence committed for its benefit by a person in a leading position within it (art. 11).

On conviction, a legal person faces a fine of up to one hundred thousand euro, and the court may also exclude it from public benefits, ban its commercial activity, place it under judicial supervision, order it wound up, or close the premises used for the offence (art. 12). The Law was published in the Official Gazette on 16 October 2015. Cyprus legislation takes effect on the date of its Official Gazette publication unless it provides a different date.

Cyprus ratified the Council of Europe Convention on Cybercrime by Law 22(III)/2004, which sets out the Convention's English and Greek texts as a schedule to the Law and gives them the force of domestic law. Article 4 of the Law as enacted makes it an offense to enter the whole or part of a computer system intentionally and without right by violating the security measures.

Article 2 of the Convention, set out in the schedule, requires each Party to criminalize intentional access without right to the whole or part of a computer system. Law 22(III)/2004 was published in the Official Gazette on 30 April 2004. Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.

Law 155(I)/2022, which its preamble states harmonises Cyprus law with EU Directive 2019/790 on copyright in the Digital Single Market, inserted new articles 24 to 48 into Cyprus's Intellectual Property Rights and Related Rights Law, including the text-and-data-mining exceptions in articles 24 and 25. Article 24 exempts reproduction and extraction by research organisations and cultural heritage institutions for scientific text-and-data mining.

Article 25 gives a general exception for reproduction and extraction of lawfully accessible works for text-and-data mining. That exception applies only where the rightholder has not expressly reserved the use in an appropriate manner, such as machine-readable means, for content made available online. The Law was published in the Official Gazette on 7 October 2022.

Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.

Article 42A, inserted to partially harmonize with the Radio Equipment Directive (Directive 2014/53/EU), requires the Digital Security Authority to ensure that radio equipment of categories or classes it designates by Decision is constructed to meet essential requirements set by the European Commission.

In particular, the equipment must not harm the network or degrade service by misusing network resources, must incorporate safeguards protecting users' and subscribers' personal data and privacy, must support features protecting against fraud, and must support features ensuring that software can be installed on the equipment only once the compatibility of that hardware-software combination has been demonstrated.

The Authority sets the specific conformity-assessment procedure, notified-body approval criteria, and market-surveillance process, including a seizure power, by its own Decision, and orders compliance measures or the elimination of risk where equipment endangers health, personal safety, or network and information-system security.

Notice K.D.P. 252/2025, published in the Official Gazette (Annex III(I), No. 5963) on 14 August 2025, is the Minister of Finance's designation of the competent authorities for Regulation (EU) 2022/2554 (DORA) in Cyprus.

It names the Superintendent of Occupational Pension Funds for occupational pension institutions, the Superintendent of Insurance for Cypriot insurance and reinsurance undertakings and the insurance intermediaries it lists, the Cyprus Securities and Exchange Commission for the investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, fund managers and crowdfunding service providers it lists, and the Central Bank of Cyprus for credit institutions, payment institutions, e-money institutions and account information service providers.

The Securities and Exchange Commission and the Central Bank each also perform the functions of the single competent authority under DORA Article 19 for the entities they supervise, and the Commission performs them for central securities depositories licensed or supervised by both bodies. The authorities exercise the powers that the Regulation and the delegated acts adopted under it provide.

Article 35 requires an essential or important entity to take appropriate and proportionate technical, operational and organisational measures, proportionate to the risk, to manage the risks to the security of the network and information systems it uses for its activities or to provide its services, covering at least risk-analysis and security policy, incident handling, business continuity and disaster recovery, supply-chain security, secure system acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policies, cyber hygiene and training, cryptography and encryption, human-resources security and access control, and multi-factor authentication, transposing NIS2 Article 21.

Article 35A requires the entity's senior management to approve these measures, oversee their implementation, and undergo (and offer staff) regular cybersecurity training, and it can be held accountable for the entity's breach of the Article 35 duty. Section 31(10) disapplies this Law's cybersecurity risk-management, incident-reporting, supervision and enforcement provisions to a financial entity that Regulation (EU) 2022/2554 (DORA) covers.

Article 35B requires an essential or important entity to notify the Digital Security Authority, without undue delay, of any incident that has a significant impact on the provision of its services, on a graduated clock: an early warning within six hours of becoming aware of the significant incident (stricter than NIS2 Article 23(4)(a)'s 24-hour floor), a fuller incident notification within 72 hours, an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every 15 days and a final report within 15 days of restoring the affected network or system).

A trust-service provider notifies within 24 hours rather than 72 for an incident affecting its trust services. The Authority responds to the early warning within 24 hours with initial feedback and, on request, guidance, and forwards the notification to the national computer security incident response team (CSIRT). Section 31(10) disapplies this Law's cybersecurity risk-management, incident-reporting, supervision and enforcement provisions to a financial entity that Regulation (EU) 2022/2554 (DORA) covers.

Article 106, paragraph 1 of Law 112(I)/2004 allows automated calling and communication systems without human intervention, fax machines and electronic mail to be used for direct commercial promotion only for subscribers or users who have given their consent in advance.

Article 106, paragraph 2 lets a person who obtained customers' electronic mail contact details in the sale of a product or service use them for direct promotion of its own similar products or services, if the customers have a clear and distinct opportunity to object, free of charge and easily, to that use when the details are collected and with every message where the user did not initially object.

Article 106, paragraph 4 prohibits electronic mail for direct commercial promotion that conceals the identity of the sender or of the person on whose behalf it is sent, that has no valid address to which the recipient can request that the communication stop, or that encourages recipients to visit websites that breach Article 9 of the Law on Certain Aspects of Information Society Services and Electronic Commerce.

Article 106, paragraph 5 applies paragraphs 1 and 3 to subscribers who are natural persons. Article 106, paragraph 6 lets any natural or legal person affected by a breach of the Article, with a legitimate interest in its ending or prohibition, including electronic communications service providers protecting their legitimate business interests, go to the competent courts.

Article 107, paragraph 2 gives the Commissioner for Personal Data Protection competence over possible breaches of Articles 99, 100, 101, 105 and 106. Article 107B, paragraph 1 lets that Commissioner impose an administrative fine of up to EUR 200,000 for a breach of the provisions of that Part of the Law. Under Article 7 of the Interpretation Law, a Law comes into force on the day of its publication in the Official Gazette unless it provides otherwise.

Article 99, paragraph 5 of Law 112(I)/2004 allows storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user only if that subscriber or user has given consent, among other things for the purpose of the processing.

The proviso to paragraph 5 does not prevent technical storage or access whose sole purpose is carrying out the transmission of a communication over an electronic communications network, or that is strictly necessary for the provider of an information society service the subscriber or user expressly requested to provide that service. Law 51(I)/2012 replaced paragraph 5 of Article 99 with the consent requirement.

Article 107, paragraph 2 gives the Commissioner for Personal Data Protection competence over possible breaches of Articles 99, 100, 101, 105 and 106. Article 107B, paragraph 1 lets that Commissioner impose an administrative fine of up to EUR 200,000 for a breach of the provisions of that Part of the Law. Under Article 7 of the Interpretation Law, a Law comes into force on the day of its publication in the Official Gazette unless it provides otherwise.

Article 99, paragraph 1 of Law 112(I)/2004 requires providers of publicly available electronic communications networks or services, and their employees, to take all due technical and organizational measures to secure the confidentiality of any communication carried over the network or service and of the related traffic data.

Article 99, paragraph 2 prohibits anyone other than the users communicating with each other from listening to, tapping, storing, interfering with or otherwise monitoring communications and the related traffic data without the consent of the users concerned, except as paragraph 3 provides. Article 99, paragraph 3 allows interference with communications in the circumstances the law provides and with the permission of a Court.

Article 99, paragraph 4 leaves untouched any recording of conversations and the related traffic data that the law permits in the course of lawful business practice to provide evidence of a commercial transaction or of any other business communication. Article 107, paragraph 2 gives the Commissioner for Personal Data Protection competence over possible breaches of Articles 99, 100, 101, 105 and 106.

Article 107B, paragraph 1 lets that Commissioner impose an administrative fine of up to EUR 200,000 for a breach of the provisions of that Part of the Law. Under Article 7 of the Interpretation Law, a Law comes into force on the day of its publication in the Official Gazette unless it provides otherwise.

Article 15(1) exempts a service provider from liability for information transmitted in an information society service that consists of transmitting information a recipient provides over a communications network, or of giving access to the network, provided the provider does not initiate the transmission, select its recipient, or select or modify the information transmitted.

Article 16(1) exempts a service provider from liability for the automatic, intermediate and temporary storage of information made for the sole purpose of making its onward transmission more efficient, provided the provider meets five conditions, including acting expeditiously to remove the stored information or disable access to it once it learns that the information has been removed from its original source, access to it has been disabled, or a court or administrative authority has ordered removal or disabled access.

Article 17(1) exempts a service provider from liability for information stored at the request of a recipient of the service if the provider has no actual knowledge of the unlawful activity or information and, for damages claims, is not aware of facts or circumstances from which it is apparent, or if on gaining such knowledge or awareness it acts expeditiously to remove the information or disable access to it.

Article 17(2) withholds that exemption where the recipient of the service acts under the authority or control of the provider. Article 17(3) leaves open a court or administrative order requiring the provider to stop or prevent an infringement. Article 18(1) imposes on providers no general obligation to monitor the information they transmit or store, and no general obligation to seek out facts or circumstances indicating illegal activity, for the services in Articles 15, 16 and 17.

Article 18(2) requires information society service providers to tell the Competent Authority promptly of suspected illegal information or activity by recipients that comes to their attention, and to give the competent authorities on request information that helps identify the recipients with whom they have storage agreements. The Competent Authority is the Minister of Commerce, Industry and Tourism.

Article 4(1) designates the Radio, Television and Digital Services Authority (Αρχή Ραδιοτηλεόρασης και Ψηφιακών Υπηρεσιών) as the Digital Services Coordinator under Article 49(2) of Regulation (EU) 2022/2065. Article 6 gives the Authority supervision of providers of intermediary services for the application of Article 26(1)(a) to (c) and (2) and Article 28(1) of the Regulation.

Article 6 gives the Ministry of Energy, Commerce and Industry supervision of Article 6(3), Article 14, Article 26(2) and Articles 30, 31 and 32 of the Regulation. Article 6 gives the Office of the Commissioner for Electronic Communications supervision of the exemptions from liability applied under Articles 4, 5 and 6 of the Regulation.

Article 6 gives the Office of the Commissioner for Personal Data Protection supervision of Article 25(2), Article 26(1)(d) and (3) and Article 28(2) and (3) of the Regulation. Article 8(2) makes the Coordinator the central point for complaints against providers of intermediary services under Article 53 of the Regulation.

Article 8(4)(α) lets the Coordinator or a competent authority request information by a specific reasoned request from providers of intermediary services and from other persons who may reasonably know of the suspected breach, and those persons must supply it without delay on the schedule and in the detail the Coordinator or authority sets.

Article 8(7) lets the Coordinator or a competent authority apply to the court for a prohibitory or mandatory order, including an interim order, against a provider of intermediary services that it considers involved in or responsible for a breach. Article 12(1) and (3) require the competent authorities to see that the orders to act against illegal content and the orders to provide information that they issue meet the conditions in Articles 9 and 10 of the Regulation.

Article 13(2) requires providers of intermediary services within the Act's scope to register in the Register of Intermediary Service Providers within three months of its operation or before they start providing intermediary services in the Republic. Article 13(1) has the Coordinator create the Register and put it into operation within twelve months of the Act's commencement.

Under Article 13(4)(α), providers must tell the Coordinator of any change in the registered details immediately and at the latest within ten days. Article 14 makes the Coordinator's decisions immediately enforceable, and a decision of the Coordinator or a competent authority may be appealed to the Administrative Court under Article 146 of the Constitution.

Article 19(3) caps the administrative fine at 6 percent of the provider's annual worldwide turnover in the preceding financial year, and at 1 percent of annual income or worldwide turnover for supplying inaccurate, incomplete or misleading information, failing to answer or correct it, or not submitting to an inspection.

Article 20(1) makes an act or omission contrary to any provision of the Regulation a criminal offence punishable by imprisonment of up to one year, a fine of up to EUR 10,000, or both. Article 20(2) caps a fine imposed under Article 20(1) at 5 percent of the provider's average daily worldwide turnover or income in the preceding financial year, per day.

Law 105(I)/1995 creates strict liability of producers for damage caused by defective products. Article 2(1) of the Law defines a product as any movable good, including one contained in another product or built into immovable property. Article 2(1) of the Law treats electricity and liquefied gas as products as well. The Law lists amendments by Laws 94(I)/1999, 113(I)/2000 and 45(I)/2002. Article 2(1) of the Law defines damage as death, personal injury or the loss of or damage to property.

Article 2(1) of the Law counts property only if it is of a kind ordinarily intended for private use or consumption and mainly used that way by the person who suffers the loss. Article 2(1) of the Law defines the producer as a person who makes a product or a component, including raw material, or presents itself as the producer by putting its name or a trade mark on the product.

Article 4(1) of the Law treats a product as defective when it does not provide safety, taking account of all the circumstances in which it is possessed, used or consumed. Article 5 of the Law makes the producer liable for damage that the injured person proves was caused wholly or partly by a defective product. Article 6 of the Law makes a person who imports a product into the Republic in the course of its business to supply it to another liable as if it were the producer.

Article 6 of the Law also makes a supplier liable as if it were the producer if it fails to comply in writing, within a reasonable time, with a written request to identify the producer or its own supplier. Article 7 of the Law forbids limiting or excluding that liability by any contract term or notice. Article 7 of the Law allows the liability to be reduced or removed where the damage is caused both by a defective product and by the fault of the injured person.

Article 8 of the Law makes two or more persons liable for the same damage jointly and severally. Article 10 of the Law awards no compensation for damage done to the defective product itself. Article 10 of the Law awards no compensation for damage to property where the amount would not exceed 300 pounds. Article 11 of the Law bars a claim brought more than three years after the injured person learned or could reasonably have learned of the damage, the defect and the identity of the producer.

Article 11 of the Law extinguishes the right ten years after the defective product was put into circulation, with two exceptions. Article 11 of the Law lifts that ten-year bar where the producer or importer gave an express guarantee that the product could be used for a longer period. Article 11 of the Law also lifts that bar where the damage was caused within the ten years but could not reasonably be discovered until a later time.

Article 12 of the Law gives a defense where the person did not put the product into circulation. Article 12 of the Law gives a defense where the defect was wholly due to compliance with a requirement imposed by or under a statutory provision. Article 12 of the Law gives a defense where it is probable that the defect did not exist when the producer put the product into circulation or appeared later.

Article 12 of the Law gives a development-risk defense where the state of scientific and technical knowledge when the product was put into circulation did not allow the defect to be discovered. Article 13 of the Law decides questions of the calculation of damage and compensation, causation, contributory negligence and contribution between co-defendants as if the liability arose from the tort of negligence. The Law entered into force on 1 January 1997.

The consultation draft of the Law on Liability for Defective Products of 2026 would keep the liability under the Law of 1995 in force for defective products placed on the market or put into service before 9 December 2026.

Article 4(1) applies the Law to general-purpose consumer computer hardware systems and their operating systems, payment terminals, the listed self-service terminals, consumer terminal equipment with interactive computing capability used for electronic communications services or for accessing audiovisual media services, and e-readers, when they are placed on the market from 28 June 2025.

A product is a substance, preparation or good produced through a manufacturing process, and the term excludes food, feed, living plants and animals, products of human origin and plant and animal products directly related to their future reproduction.

Article 5(2) requires all products to meet Section I of Annex I and, except self-service terminals, Section II of Annex I. Section I of Annex I requires products to be designed and produced to maximise their foreseeable use by persons with disabilities and, where possible, to come with accessible information on their operation and accessibility features.

Section I of Annex I requires the product and its user interface to contain features, elements and functions that let persons with disabilities access, perceive, operate, understand and control the product. Section I of Annex I requires self-service terminals to provide text-to-speech technology and to allow the use of personal headsets, among other specific requirements.

Section I of Annex I also requires e-readers to provide text-to-speech technology, consumer terminal equipment used for electronic communications services to handle real-time text and total conversation where it has text or video capabilities, and consumer terminal equipment used to access audiovisual media services to make available the accessibility components that the audiovisual media service provider supplies.

Article 8 requires a manufacturer to ensure that products it places on the market are designed and manufactured in accordance with the applicable accessibility requirements. Article 8 requires a manufacturer to draw up the technical file under Annex II, carry out or commission the conformity assessment procedure, and, where conformity is shown, draw up the EU declaration of conformity and affix the CE marking.

Article 8 requires a manufacturer to keep the technical file and the EU declaration of conformity for five years from the date the product was placed on the market. Article 8 requires a manufacturer to ensure that the product comes with instructions and safety information in a language easily understood by consumers and other end users, as the competent authority determines by Notification in the Official Gazette.

Article 8 requires a manufacturer that considers a product it placed on the market non-conforming to take corrective measures or withdraw it, inform the competent authority, and keep a register of non-conforming products and related complaints. Article 8 requires a manufacturer to give the competent authority and the accessibility surveillance authorities, on a reasoned request, the information and documentation needed to show conformity, and to cooperate with them.

Article 9 lets a manufacturer appoint an authorised representative by written mandate. Article 9(4) requires the mandate to give the representative at least the task of keeping the EU declaration of conformity and the technical file at the disposal of the authorities for five years.

Article 12 treats an importer or distributor as a manufacturer, with the manufacturer's obligations, when it places a product on the market under its own name or trademark or modifies a product already on the market in a way that may affect conformity. Article 13 requires the operators named in Articles 8 to 11 to identify to the competent authority any operator that supplied them with a product or to which they supplied one, for five years.

Article 15(1) applies the accessibility requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the basic nature of the product or service and does not impose a disproportionate burden on the economic operators. Article 15(4) exempts microenterprises dealing with products from the requirement to document their assessment.

Article 16(1) presumes that products and services that conform to harmonised standards, or parts of them, whose references the Official Journal of the European Union publishes meet the accessibility requirements to the extent the standards cover them. Article 16(2) gives the same presumption to conformity with technical specifications that the European Commission adopts under Article 15 of the Directive.

Article 17 provides that the EU declaration of conformity shows that the applicable accessibility requirements are met and, where Article 15 is invoked, names the requirements covered by that exception. Article 17(2) requires the EU declaration of conformity to follow the model in Annex III to Decision 768/2008/EC, to contain the elements in Annex II of the Law, to be kept updated and to be translated into the languages that the competent authority sets by Notification in the Official Gazette.

Article 19 requires the CE marking to be affixed visibly, legibly and indelibly to the product or its data plate, unless the nature of the product does not allow it.

Article 4(2) applies the Law to the listed services that are provided to consumers from 28 June 2025.

The listed services are electronic communications services other than machine-to-machine transmission services, services providing access to audiovisual media services, the websites, mobile services, electronic tickets and transport information of air, bus, rail and waterborne passenger transport together with interactive self-service terminals, consumer banking services, e-books and dedicated software, and e-commerce services.

For urban, suburban and regional transport services the Law applies only to the interactive self-service terminals. For passenger transport information screens, Article 4(2) covers only interactive screens within the territory of the Union. For passenger transport self-service terminals, Article 4(2) covers only interactive terminals within the territory of the Union, other than those installed as integral parts of vehicles, aircraft, ships or rolling stock.

A consumer is a natural person who buys a product or receives a service for purposes unrelated to the person's trade, business, craft or profession. Consumer banking services are credit agreements within Directives 2008/48/EC and 2014/17/EU, investment services within the points of Directive 2014/65/EU that Article 2 names, payment services, services linked to payment accounts, and electronic money.

Article 4(4) excludes from the Law pre-recorded time-based media and office file formats published before 28 June 2025, online maps and mapping services where the essential navigation information is accessible, third-party content that the operator does not fund, develop or control, and archived content. Article 4(5) applies the Law subject to Directive (EU) 2017/1564 and Regulation (EU) 2017/1563.

Article 5(3) requires all services to meet Section IV of Annex I and, other than urban, suburban and regional transport services, Section III of Annex I. Section III of Annex I requires consistent and adequate accessibility of websites, related online applications, mobile device services and mobile applications.

Section IV of Annex I requires consumer banking services to offer identification methods, electronic signatures, security and payment services that users can perceive, use and understand and rely on, and to give information that does not exceed level B2 of the Common European Framework of Reference for Languages.

Section IV of Annex I requires services giving access to audiovisual media services to provide electronic programme guides that are perceivable, usable, understandable and reliable, and to transmit subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation with adequate quality and synchronisation.

Section IV of Annex I requires e-commerce services to provide the accessibility information on the products and services sold where the responsible economic operator supplies it, to make the identification, security and payment function accessible where it is part of the service rather than of a product, and to offer accessible identification methods, electronic signatures and payment services.

Article 5(5) exempts microenterprises that provide services from those requirements and from any other obligation relating to compliance with them. Article 2 defines a microenterprise by its number of employees and by its annual turnover or its annual balance sheet total. Article 4(5) of the Directive exempts microenterprises providing services from the service requirements and from any obligations relating to compliance with them.

Article 5(6) requires the competent authority to give guidelines and tools to microenterprises. Article 5(4) has the competent authority specify by Notification in the Official Gazette measures for adapting the built environment related to the services. Article 4(4) of the Directive lets a Member State decide that the built environment used by clients of covered services must meet the requirements of Annex III to the Directive.

Article 14 requires each service provider to design and provide services in accordance with the accessibility requirements of the Law. Article 14 requires a provider to draw up the information required by Annex III, explain how the services meet the requirements and make it available to the public in written and oral form, including in a way accessible to persons with disabilities.

Annex III requires the provider to include that information in its general terms and conditions or an equivalent document, in addition to the consumer information that Directive 2011/83/EU requires, with a general description of the service in an accessible format, the descriptions needed to understand how it works, and a description of how it meets the requirements of Annex I. Article 14 requires a provider to have procedures so that the provision of services stays in conformity, taking account of changes in the service and in the applicable requirements and standards.

Article 14 requires a provider whose service does not conform to take the corrective measures needed and to inform the competent authority at once. Article 14 requires a provider to give the competent authority and the accessibility surveillance authorities the information needed to show conformity on a reasoned request, and to cooperate with them.

Article 15(1) applies the accessibility requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the basic nature of the product or service and does not impose a disproportionate burden on the economic operators. Article 14(1) of the Directive applies the accessibility requirements only to the extent that compliance does not require a fundamental alteration and does not impose a disproportionate burden.

Article 15(3) requires operators to document the assessment and keep the results for five years. Article 15(5) requires a service provider that relies on the disproportionate burden defence to renew its assessment for each category or type of service when the service changes, when the authorities ask, and at least every five years.

Article 15(6) bars an operator that receives funding from other sources for the purpose of improving accessibility from relying on the disproportionate burden defence. Article 15(7) requires an operator other than a microenterprise that relies on Article 15(1) for a particular product or service to inform the competent authority.

Article 16(1) presumes that products and services that conform to harmonised standards, or parts of them, whose references the Official Journal of the European Union publishes meet the accessibility requirements to the extent the standards cover them. Article 16(2) gives the same presumption to conformity with technical specifications that the European Commission adopts under Article 15 of the Directive.

Article 25(2) presumes that a product or service whose features, elements or functions meet Section VI of Annex I fulfils the accessibility obligations in other Union acts for those features, elements or functions, unless those acts provide otherwise. Article 6 treats services that meet the accessible-information requirements of the passenger rights regulations as conforming to the corresponding requirements of the Law, except where the Law adds requirements.

Article 45(1) provides a transitional period ending on 28 June 2030 in which service providers may keep providing their services using products they lawfully used for similar services before that date. Article 45(1) lets service contracts agreed before 28 June 2025 continue without change until they expire, and for five years at most from that date.

Article 45(2) lets self-service terminals lawfully used before 28 June 2025 stay in use for similar services until the end of their economically useful life, and for twenty years at most from the start of their use. Article 32(2) of the Directive lets a Member State allow self-service terminals lawfully used before 28 June 2025 to stay in use for no longer than twenty years after their entry into use.

Article 3(1) makes the Deputy Minister of Social Welfare the competent authority for exercising the powers and applying the provisions of the Law and of the Regulations, Orders and Notifications made under it. Article 3(3) has the Council of Ministers designate the departments and services of the public service that cooperate with the competent authority and carry out market surveillance, according to their staffing and subject expertise.

Article 20(2) requires the authorities, when an operator has invoked Article 15, to check that the assessment was carried out, to review it against the criteria in Annex IV, and to check compliance with the accessibility requirements. Article 20(1) applies listed articles of Regulation (EU) 2019/1020 to the market surveillance of products.

Article 21(1) requires economic operators to cooperate fully with the authorities' evaluation of a product they have sufficient reason to believe does not comply, and Article 21(4) requires each operator to ensure that appropriate corrective action is taken for the products it made available in the Union.

Article 21(2) requires the authorities, where a product does not comply, to ask the operator to take corrective measures within a reasonable period and, if it does not, to withdraw the product from the market within a further reasonable period. Article 23(2) requires the authorities, where a formal non-compliance persists, to take measures to restrict or prohibit the making available of the product or to ensure its withdrawal from the market.

Article 24(1) requires the authorities to take action to examine complaints or reports about services that do not meet the accessibility requirements. Article 27 empowers the authorities to carry out unannounced on-site inspections and physical checks of products and services, among other powers. Article 33(2) lets the authorities require an operator to prevent a product or service being made available, to withdraw or recall a product, or to ban the provision of a service.

Article 34 lets the authorities serve a notice of withdrawal, a notice of recall, or a notice of destruction of a product or discontinuance of use of a service. Article 35 lists the infringements, including making available a non-complying product or service, failing to comply with a notice under Article 34, and making a product available without the EU declaration of conformity or the CE marking, for which the competent authority may impose an administrative fine.

Article 36(1) lets the competent authority impose an administrative fine of up to EUR 10,000 for an Article 35 infringement and, for a later infringement, of up to EUR 20,000. Article 36(2) lets the competent authority impose a fine of up to EUR 500 for each day a fined infringement continues. Article 37(3) requires the fine to be imposed by a reasoned decision after the person has had the opportunity to be heard orally or in writing.

Article 37(4) has the authority collect the fine once the period of seventy-five days for an appeal to the Administrative Court has passed without an appeal. Article 38 makes it an offence, beside the administrative fine, to make a non-complying product or service available, to disregard a notice under Article 34, to issue or use a certificate or other document without approval or without the proper procedure, or to give false, misleading or inaccurate details to the authorities.

A first conviction under Article 38 carries imprisonment of up to 2 years or a fine of up to EUR 20,000 or both, and a later conviction imprisonment of up to 3 years or a fine of up to EUR 30,000 or both. Article 40(1) lets the authorities ask the operator to pay the costs they incurred in buying, examining and testing the product or service and checking documents, where a notice under Article 33 or 34 follows.

Article 40(2) requires an operator that asks the competent authority to allow a product or service back on the market, or to lift a ban imposed because it lacks the CE marking or the required documents, to pay in advance the expected costs of examination, testing and checking documents, whatever the result.

Article 39 lets a court that convicts a person of an Article 38 offence, or orders a product forfeited or a service banned, order the convicted person or any economic operator to repay the authorities' costs of seizure and detention, of carrying out forfeiture directions and of exercising their powers. Article 43 lets a consumer apply to a court, in accordance with the law in force, or to the competent authority to obtain application of the Law.

Article 43 does not apply to contract award procedures governed by the public procurement law and the utilities procurement law. Article 30 of the Directive requires Member States to lay down rules on penalties for infringements of the national provisions, which must be effective, proportionate and dissuasive.

Article 2 defines a distributor as a natural or legal person in the supply chain, other than the manufacturer and the importer, that makes a product available on the market. Article 11 requires a distributor to act with due care in relation to the requirements of the Law when it makes a product available on the market.

Article 11 requires a distributor, before making a product available, to verify that it bears the CE marking, comes with the required documents, instructions and safety information in a language easily understood in the Republic, and that the manufacturer and importer met their identification duties.

Article 11 forbids a distributor to make a product available while it considers or has reason to believe that the product does not comply, until it complies, and requires it to inform the manufacturer or importer and the competent authority. Article 11 requires a distributor that considers a product it made available non-compliant to ensure that corrective measures are taken or the product is withdrawn, and to inform the competent authority.

Article 11 requires a distributor to give the authorities, on a reasoned request, the information and documentation needed to show conformity and to cooperate with them. Article 12 treats a distributor as a manufacturer when it places a product on the market under its own name or trademark or modifies a product already on the market in a way that may affect conformity.

Article 13 requires a distributor to identify to the competent authority any operator that supplied it with a product or to which it supplied one, for five years. Article 15(1) applies the accessibility requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the basic nature of the product or service and does not impose a disproportionate burden on the economic operators.

Article 2 defines an importer as a natural or legal person established in the Union that places a product from a third country on the Union market. Article 10 requires an importer to place on the market only products that comply with the accessibility requirements of the Law.

Article 10 requires an importer, before placing a product on the market, to ensure that the manufacturer carried out the conformity assessment procedure and drew up the technical file, and that the product bears the CE marking and comes with the required documents. Article 10 forbids an importer to place a product on the market while it considers or has reason to believe that the product does not comply, until it complies, and requires it to inform the manufacturer and the competent authority.

Article 10 requires an importer to indicate its name, registered trade name or trademark and contact address on the product, packaging or accompanying document, in a language easily understood by end users and the accessibility surveillance authorities. Article 10 requires an importer to keep a copy of the EU declaration of conformity for five years at the disposal of the authorities and to ensure that the technical file can be made available to them.

Article 10 requires an importer that considers a product it placed on the market non-compliant to take corrective measures or withdraw it, inform the competent authority, and keep a register of non-compliant products and complaints. Article 10 requires an importer to give the authorities, on a reasoned request, the information and documentation needed to show conformity and to cooperate with them.

Article 12 treats an importer as a manufacturer when it places a product on the market under its own name or trademark or modifies a product already on the market in a way that may affect conformity. Article 13 requires an importer to identify to the competent authority any operator that supplied it with a product or to which it supplied one, for five years.

Article 15(1) applies the accessibility requirements only to the extent that compliance does not require a significant change resulting in a fundamental alteration of the basic nature of the product or service and does not impose a disproportionate burden on the economic operators.

Article 30B(1) requires audiovisual media service providers under the jurisdiction of the Republic to ensure, without undue delay, that their services are made continuously and progressively more accessible to persons with disabilities through proportionate measures. Article 30B(1) names subtitling of programmes, sign language, audio description and spoken subtitling as the means by which accessibility is achieved in particular.

Section 28 of Law 197(I)/2021 replaced Article 30B(1) with that text and added paragraphs (2A) to (2C), (4) and (5). Article 30B(2) requires every television organisation to broadcast between 18.00 and 22.00 a special news bulletin that the deaf can follow, lasting at least five minutes in the hour, shown on at least half of the television screen. Article 30B(2A) requires providers to report to the Authority regularly on the measures they apply under paragraph (1).

Article 30B(2C) requires providers to develop accessibility action plans, notified to the Authority, for the continuous and gradual increase of accessibility. Article 30B(3) requires providers, after consulting the Authority, to submit a timetable that sets specific ways to increase gradually the share of their programmes, beyond news bulletins, that is made accessible to persons with a visual or hearing disability.

Article 30B(4) has the Authority designate a single, easily accessible online contact point for information and complaints on accessibility issues. Article 30B(5) requires providers to give emergency information made available to the public through their services, including public announcements in natural disasters, in a way accessible and understandable to persons with disabilities.

Article 41B(1) lets the Authority impose an administrative fine for each day of infringement of the Law or its Regulations, within the ceiling the text sets for each class of licensee. Article 41B(2) requires the Authority to take account of the nature, gravity, frequency and duration of the infringement and the principle of proportionality.

Article 41A(2) defines the administrative sanctions the Authority may impose as a recommendation, a warning, suspension of the operation of a television or radio organisation for up to three months, revocation of its licence, or an administrative fine under Article 41B. Article 41Γ lets the Authority apply to the court, whatever administrative sanction it imposes, for a prohibitory or mandatory order, including an interim order, against an audiovisual media service provider responsible for an infringement.

Article 41ΣΤ gives any person directly affected by an infringement the right to complain to the Authority and to bring a civil action against the offending television or radio organisation. Article 55 provides that, subject to the Authority's competences under Article 3, nothing in the Law affects the Cyprus Broadcasting Corporation or any other radio or television organisation operating under a special law or under international or interstate agreements.

The Official Gazette published Law 197(I)/2021 on 23 December 2021. Section 7 of the Interpretation Law puts a Law in force on the day of its publication in the Official Gazette unless the Law provides otherwise.

Article 6(1) provides that a person with a disability receives equal treatment with the other citizens of the Republic in the provision of goods, facilities or services. Article 6(1) treats as discrimination the provision to a person with a disability of treatment that is less favourable than that given to another person, relates to a ground connected with the disability and is not justified.

Article 6(2) lists as unequal treatment the refusal of services, the offer of services of a lower standard, the offer of goods and services on inferior terms, and the failure to make changes to services or facilities that makes their use impossible or unjustifiably difficult for a person with a disability.

Article 6(2) gives as examples of such changes the creation of suitable means of access and facilities for comfortable and safe use, and the use of special means, instruments or persons for communication and information for certain categories of persons with disabilities. Article 8(3) provides that television stations are to make arrangements so that, for certain hours, news bulletins are comprehensible to the deaf.

Article 9(1) provides that the principles of Articles 4, 5, 6 and 8 apply through appropriate measures that ensure reasonable accommodation to the maximum of the available resources. Article 9(2) defines reasonable accommodation as the necessary and appropriate modifications and adjustments that do not impose a disproportionate or unjustified burden, and treats a burden as not disproportionate when measures taken under State policy for persons with disabilities sufficiently offset it.

Article 9(3) makes it an offence for a person, without reasonable cause, to commit an act, action or omission that amounts to adverse discrimination against a person with a disability, punishable by a fine of up to four thousand pounds or imprisonment of up to six months or both. Article 9(3) provides that reasonable cause includes all cases where the appropriate measures to ensure reasonable accommodation cannot be taken or were not taken.

Article 9(4) punishes the officer of a legal person who consented to, connived at or tolerated the offence, and punishes the legal person with a fine of up to seven thousand pounds. Article 9(5) sets a fine of up to two thousand pounds for an offence committed by gross negligence, and four thousand pounds for the legal person.

Article 9Γ entitles any person who considers that a breach of the Law affects them in relation to discriminatory treatment to complain to the Commissioner for Administration, who examines the complaint under the Combating of Racial and Certain Other Discrimination (Commissioner) Law. Article 9Δ lets organisations or legal persons with a legitimate interest in ensuring that the Law is observed exercise that right with the complainant's approval, on the complainant's behalf or in support.

The right to sue in court under Article 9A concerns discriminatory treatment in employment. Article 29 brings the Law into force on its publication in the Official Gazette, except Articles 5 and 14 to 24, which come into force on a day the Council of Ministers sets by Notification. The Official Gazette No. 3420 of 21 July 2000 published the Law.

Article 39(1)(b) requires the technical specifications for all contracts intended for use by natural persons, whether the general public or the staff of the contracting authority, to take account of accessibility criteria for persons with disabilities or design for all users. Article 39(1)(b) requires the technical specifications to refer to mandatory accessibility standards where a legislative act of the Union has adopted them.

Article 2(1) defines contracting authorities as the State, the regional or local authorities and the bodies governed by public law. For the products and services listed in Article 4 of Law 57(I)/2024, Article 25(1) of that Law makes the accessibility requirements of its Annex I mandatory accessibility requirements when Article 39(1) of this Law is applied.

For the products and services referred to in its Article 2, Article 24(1) of the Directive makes the accessibility requirements of Annex I to the Directive mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU. Article 95(1) brings the Law into force on its publication in the Official Gazette. The Official Gazette No. 4565 of 28 April 2016 published the Law.

Article 54(1)(b) requires the technical specifications for all contracts intended for use by natural persons, whether the general public or the staff of the contracting entity, to take account of accessibility criteria for persons with disabilities or design for all users. Article 54(1)(b) requires the technical specifications to refer to mandatory accessibility requirements where a legislative act of the Union has adopted them.

For the products and services listed in Article 4 of Law 57(I)/2024, Article 25(1) of that Law makes the accessibility requirements of its Annex I mandatory accessibility requirements when Article 54(1) of this Law is applied. Article 2(1) defines contracting entities as contracting authorities or public undertakings that carry out an activity listed in Articles 13 to 19, and other entities that carry out such an activity on the basis of special or exclusive rights.

Article 109(1) brings the Law into force on its publication in the Official Gazette. The European Union's list of national transposition measures for Directive 2014/25/EU records the Law's publication in Official Gazette No. 4586 of 23 December 2016.

A video-sharing platform provider under the jurisdiction of Cyprus must take appropriate measures to protect minors from content that may harm their physical, mental, or moral development, including the installation and operation of age-verification systems for users of the platform in relation to such content, per Article 32ΣΤ(8)(στ) of the Radio and Television Organisations Law.

Personal data of minors collected under these measures may not be processed for commercial purposes such as direct marketing, profiling, or behavioural advertising, per Article 32ΣΤ(9). The Cyprus Radio Television Authority may impose an administrative fine of up to 5 percent of the provider's turnover for the preceding financial year, or up to 500,000 euros, for breach of Article 32ΣΤ, per Article 32Ζ(2).

Law 197(I)/2021, which inserted the article, was published in the Official Gazette on 23 December 2021. Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.

Press publishers established in a member state hold an exclusive right to authorise or prohibit the reproduction and online making-available of their press publications by information-society service providers, per new Article 36(1) of Cyprus's Intellectual Property and Related Rights Law. The right does not reach private or non-commercial use by individual users, per Article 36(2).

Nor does it reach hyperlinks that only lead the user to the press publication on the publisher's own webpage and use no other form of link such as framing technology, or the use of single words or very short extracts, per Article 36(3). The right lasts two years from the publication's release, calculated from 1 January of the following year, and does not apply to publications first published before 6 June 2019, per Article 36(7).

Authors whose works are incorporated in a press publication are entitled to an appropriate share of the revenue publishers receive for its use, per Article 36(9). Law 155(I)/2022, which inserted the article, was published in the Official Gazette on 7 October 2022. Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.