Cyprus Processing of Personal Data Law No. 125(I)/2018 - GDPR National Implementation

What Cyprus Processing of Personal Data Law No. 125(I)/2018 - GDPR National Implementation requires

Cyprus's The Processing of Personal Data (Protection of Individuals) Law No. 125(I)/2018 (Ο περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2018, Law No. 125(I)/2018), published in the Official Gazette of the Republic of Cyprus and in force from 31 July 2018, is Cyprus's primary national legislation supplementing the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) in Cyprus. The GDPR is directly applicable Cypriot law by virtue of Cyprus's EU membership. Law No. 125(I)/2018 provides national derogations, additions, and specifications that the GDPR permits EU member states to adopt, replacing the prior Processing of Personal Data (Protection of Individuals) Law No. 138(I)/2001. Cyprus is an Eastern Mediterranean EU member state with particular strategic importance as a financial services and shipping hub; many international companies maintain registered offices and regional headquarters in Cyprus, making GDPR and Law No. 125(I)/2018 compliance significant for international operations. Cyprus's common law legal system (inherited from British administration) means Cypriot data protection law operates within a framework more familiar to common law practitioners than most other EU member states. Enforcement: the Commissioner for Personal Data Protection (CPDP, Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) is Cyprus's independent data protection supervisory authority. The CPDP is Cyprus's representative on the European Data Protection Board (EDPB) and participates in the EDPB's one-stop-shop mechanism for cross-border processing. Key Cypriot national provisions: (1) Age of digital consent: Cyprus has maintained the GDPR default of 16 years for information society services; data subjects under 16 require parental or guardian consent; (2) Employment - Cypriot employment law (including the Termination of Employment Law, Chapter 217 and the Equal Treatment in Employment Regulation) governs employment relationships; employee monitoring requires advance notification; (3) Freedom of expression - exemptions for journalistic, literary, and artistic processing aligned with GDPR Art. 85; (4) Health data - specific provisions for health data processing under Cypriot health legislation supplementing GDPR Art. 9; (5) Criminal data - Law No. 125(I)/2018 restricts private entity processing of criminal conviction data; (6) Financial services - the Cyprus Securities and Exchange Commission (CySEC) supervises financial services entities; CySEC regulations interact with GDPR compliance for Cypriot-licensed financial firms. Fines: GDPR administrative fines apply in Cyprus - up to EUR 20 million or 4% of global annual turnover. The CPDP has imposed administrative fines and issued enforcement guidance in employment, financial services, and public sector contexts.

Pillar: Cybersecurity · Authority: Commissioner for Personal Data Protection (CPDP, Cyprus) · Version: 1.0.0 · Last updated: 2026-04-27

Primary source: https://www.dataprotection.gov.cy/

SHA-256 integrity: 9bcd687d1108ba2b711a69c7bfe4cb1f72bb5c4f80e8e5153047f1d32a26899d

Primary Citations — 6 traced to source

• Law No. 125(I)/2018 - The Processing of Personal Data (Protection of Individuals) Law (Cyprus) - published Official Gazette of the Republic of Cyprus; in force 31 July 2018; supplements EU GDPR; national derogations: age of digital consent 16 years (GDPR default maintained); criminal data restrictions for private entities; research and statistics derogations; freedom of expression exemptions; common law jurisdiction framework; replaces Law No. 138(I)/2001
• EU GDPR (Regulation (EU) 2016/679) - directly applicable in Cyprus; fines up to EUR 20 million or 4% of global annual turnover; CPDP is Cyprus's supervisory authority and EDPB member; 72-hour breach notification to CPDP under Art. 33; DPIA mandatory for high-risk processing under Art. 35; CPDP enforcement in financial services, employment, and public sector contexts

+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/cy-pdp-law-125-2018.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/cy-pdp-law-125-2018.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/cy-pdp-law-125-2018
• Back to registry: Browse all 10,108 compliance nodes