Cyprus

Law 29(I)/2026 inserted new articles 49 and 50 into Cyprus's Intellectual Property and Related Rights Law, defining a deepfake product by reference to Article 3(60) of the EU AI Act. A deepfake imitation of a performer's performance, or of a natural person's personal physical characteristics including voice and biometric data, may not be made available to the public without that person's explicit consent.

An exception exists for satire, parody, caricature, or political and social commentary, unless the imitation amounts to disinformation posing a serious risk to the rights or essential interests of the affected person or others. The right lasts until 50 years after the death of the performer or the person depicted.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Secondary commentary (Harris Kyriakides) describes Law 125(I)/2018 as prohibiting the processing of genetic and biometric data for life and health insurance purposes, and as requiring separate, specific consent, over and above the ordinary GDPR consent standard, where a controller relies on consent as the lawful basis for processing genetic or biometric data.

The provision's own text and article number are not independently confirmed; neither addition distinguishes voice or face capture from any other biometric modality in the commentary consulted. No Cyprus-specific voiceprint or faceprint case or regulatory guidance was located.

A controller must notify the ODPC without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Cyprus, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Law 125(I)/2018 derogation from this timeline is identified.

Cyprus's private-sector regime is the General Data Protection Regulation (GDPR) plus Law 125(I)/2018 (The Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data Law of 2018), published in the Official Gazette of the Republic of Cyprus on 31 July 2018, supplying domestic derogations and procedural rules. The Office of the Commissioner for Personal Data Protection (ODPC) is the supervisory authority. The law's official English translation has not been located, so the article-level detail below rests on commentary.

Transferring personal data of a person in Cyprus outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Law 125(I)/2018 derogation broadening or narrowing this is identified.

General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing, restated by Law 125(I)/2018 without narrowing per its own summary. No Cyprus-specific broadening of data-subject rights beyond the GDPR baseline is identified.

The Office of the Commissioner for Personal Data Protection (ODPC) is the supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. Law 125(I)/2018 Article 32(3) narrows the ceiling only for a public authority or public body's non-profit-making activities, to EUR 200,000; no narrower Cyprus-specific ceiling applies to a private-sector controller or processor, and no dedicated collective-redress statute is identified.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Cyprus ratified the Council of Europe Convention on Cybercrime by Law 22(III)/2004, which sets out the Convention's English and Greek texts as a schedule to the Law and gives them the force of domestic law. Article 2 of the Convention requires each Party to criminalise intentional access without right to the whole or part of a computer system, and Article 13 requires that offences under Articles 2 to 11 carry effective, proportionate and dissuasive sanctions involving deprivation of liberty. The ratifying Law does not itself state a domestic commencement day distinct from its Gazette publication.

Law 155(I)/2022, which its preamble states harmonises Cyprus law with EU Directive 2019/790 on copyright in the Digital Single Market, inserted new articles 24 and 25 into Cyprus's Intellectual Property Rights and Related Rights Law. Article 24 exempts reproduction and extraction by research organisations and cultural heritage institutions for scientific text-and-data mining.

Article 25 gives a general exception for reproduction and extraction of lawfully accessible works for text-and-data mining. That exception applies only where the rightholder has not expressly reserved the use in an appropriate manner, such as machine-readable means, for content made available online.

Article 42A, inserted to partially harmonize with the Radio Equipment Directive (Directive 2014/53/EU), requires the Digital Security Authority to ensure that radio equipment of categories or classes it designates by Decision is constructed to meet essential requirements set by the European Commission.

In particular, the equipment must not harm the network or degrade service by misusing network resources, must incorporate safeguards protecting users' and subscribers' personal data and privacy, must support features protecting against fraud, and must support features ensuring that software can be installed on the equipment only once the compatibility of that hardware-software combination has been demonstrated.

The Authority sets the specific conformity-assessment procedure, notified-body approval criteria, and market-surveillance process, including a seizure power, by its own Decision, and orders compliance measures or the elimination of risk where equipment endangers health, personal safety, or network and information-system security.

Article 35 requires an essential or important entity to take appropriate and proportionate technical, operational and organisational measures, proportionate to the risk, to manage the risks to the security of the network and information systems it uses for its activities or to provide its services, covering at least risk-analysis and security policy, incident handling, business continuity and disaster recovery, supply-chain security, secure system acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policies, cyber hygiene and training, cryptography and encryption, human-resources security and access control, and multi-factor authentication, transposing NIS2 Article 21.

Article 35A requires the entity's senior management to approve these measures, oversee their implementation, and undergo (and offer staff) regular cybersecurity training, and it can be held accountable for the entity's breach of the Article 35 duty.

Article 35B requires an essential or important entity to notify the Digital Security Authority, without undue delay, of any incident that has a significant impact on the provision of its services, on a graduated clock: an early warning within six hours of becoming aware of the significant incident (stricter than NIS2 Article 23(4)(a)'s 24-hour floor), a fuller incident notification within 72 hours, an intermediate report on the Authority's request, and a final report within one month of the incident notification (or, for an incident still ongoing at that point, a progress report every 15 days and a final report within 15 days of restoring the affected network or system).

A trust-service provider notifies within 24 hours rather than 72 for an incident affecting its trust services. The Authority responds to the early warning within 24 hours with initial feedback and, on request, guidance, and forwards the notification to the national CSIRT.

A video-sharing platform provider under the jurisdiction of Cyprus must take appropriate measures to protect minors from content that may harm their physical, mental, or moral development, including the installation and operation of age-verification systems for users of the platform in relation to such content, per Article 32ΣΤ(8)(στ) of the Radio and Television Organisations Law.

Personal data of minors collected under these measures may not be processed for commercial purposes such as direct marketing, profiling, or behavioural advertising, per Article 32ΣΤ(9). The Cyprus Radio Television Authority may impose an administrative fine of up to 5 percent of the provider's turnover for the preceding financial year, or up to 500,000 euros, for breach of Article 32ΣΤ, per Article 32Ζ(2).

Press publishers established in a member state hold an exclusive right to authorise or prohibit the reproduction and online making-available of their press publications by information-society service providers, per new Article 36(1) of Cyprus's Intellectual Property and Related Rights Law. The right does not reach private or non-commercial use by individual users, per Article 36(2).

Nor does it reach mere hyperlinks that only lead to the article, or the use of single words or very short extracts, per Article 36(3). The right lasts two years from the publication's release, calculated from 1 January of the following year, and does not apply to publications first published before 6 June 2019, per Article 36(7). Authors whose works are incorporated in a press publication are entitled to an appropriate share of the revenue publishers receive for its use, per Article 36(9).