🇨🇾Law 125(I)/2018 on Personal Data Processing and Free Movement
Law Providing for the Protection of Natural Persons with Regard to Processing of Personal Data and Free Movement of Such Data
Cyprus applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.
Status: In force from 31 July 2018; amendment Law 26(I)/2022 checked separately
Citation: Law 125(I)/2018, especially ss. 8-18 and 28-33
Regulator: Commissioner for Personal Data Protection
Source basis: Cyprus government-hosted English PDF downloaded and cross-checked against the Commissioner publication and current amendment trail on 22 August 2026.
How the national law fits with GDPR
The Law implements GDPR opening clauses in Cyprus and adds national provisions for children, genetic and biometric data, filing-system combinations, restrictions, DPOs, special-data transfers, expression, research and enforcement.
National additions and variations
- Section 8 sets 14 as the age for consent-based information-society services offered directly to a child; below 14 consent must come from the holder of parental responsibility.
- Section 9 prohibits genetic and biometric data processing for health and life-insurance purposes and requires separate consent for further processing where consent is the basis.
- Section 10 subjects combinations of specified large-scale public filing systems to a DPIA and prior consultation, with additional conditions imposed by the Commissioner where appropriate.
- Sections 11-13 require tightly governed assessments and Commissioner involvement for specified rights restrictions, breach-communication restrictions and legislative processing measures.
- Section 18 regulates Article 49 transfers of special-category data, while sections 28-31 contain expression, archive, research and statistics rules that require safeguards and prohibit decisions producing legal or similarly significant effects from research data.
The government-hosted English PDF is expressly an unofficial translation of the 2018 enactment. The Greek official text and the 2022 amendment control.
Operational approach
First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.
Do not treat GDPR compliance as automatic compliance with Law 125(I)/2018. Record the national trigger, the responsible owner, the local procedure and the current official source reviewed.