GDPR and your company website in Cyprus: what the law requires in 2026

What the site must say about the company

If a company has a website, the site must show its name, registration number, whether it is a private or public company, and its registered office — art. 103(1Α) of the Companies Law (Cap. 113). If the site mentions share capital, it must be the issued and paid-up capital; a company in liquidation must say so.

The e-commerce law 156(I)/2004, art. 8, adds the geographic address, email, VAT number and, for licensed activities, the supervisory authority; for regulated professions, the professional body and title. Prices must be shown “clearly and unambiguously”, stating whether tax and delivery are included. All of this must be permanently accessible, not only at checkout: usually the footer and the “About” page.

The cookie banner as the Cyprus Commissioner reads it

The Cyprus cookie rule is art. 99(5) of the electronic communications law 112(I)/2004: storing anything in a visitor’s browser requires consent, except for cookies without which the site cannot provide the service requested (basket, login, language choice). The Data Protection Commissioner enforces it, and the fine ceiling under this law is €200,000, separate from GDPR fines.

The Commissioner’s official position on cookies comes down to a few rules:

• Analytics need consent. Traffic statistics, Google Analytics included, “are not exempt from the obligation to obtain consent”, because the site works without them.
• Rejecting is as easy as accepting: the same number of clicks, at the same level. A “Reject” button hidden in a second-layer settings screen does not qualify, and nudging users with font size or colour is not allowed either.
• Pre-ticked boxes, “by continuing to browse you agree”, scrolling and closing the banner are not consent.
• Consent is given per purpose, and a link to change the choice is always available.
• For each cookie or group, state the name, category, purpose, retention period and any third parties setting cookies through the site.
• Blocking the whole site until the visitor agrees (a cookie wall) is not allowed.

In practice, analytics and ad pixels must load only after consent, not together with the banner. You can check this in a minute: open the site in a private window and look in the browser’s Network tab for requests to google-analytics.com or facebook.com before any click. An example from the Commissioner’s practice: Aylo Freesites Ltd was fined €10,400 specifically “for unlawful use of cookies” (decision published in March 2025).

Privacy notice and enquiry forms

Every form on the site — enquiry, subscription, booking, chat — is processing of personal data. Under art. 13 GDPR the person must be told, before submitting: who processes the data and how to contact them, for what purpose and on what legal basis, who receives it, whether it leaves the EU, how long it is kept, what rights the person has and that they may complain to the Commissioner. Usually that is a privacy notice linked under every form.

What to check in your forms:

• Legal basis. Answering an enquiry needs no consent — it is a step towards a contract (art. 6(1)(b) GDPR). A “I agree to processing” box is needed when the data goes to an optional purpose, such as a newsletter — and then it is not pre-ticked and not required to send the enquiry.
• Unnecessary fields. The less data a form collects, the less you have to protect and describe.
• Age. If the service is aimed at children too and relies on their consent, in Cyprus a child can consent alone from 14 (art. 8 of Law 125(I)/2018), not 16 as the GDPR default.
• Vendors. Hosting, CRM, the email service and the chat are processors; each needs a data processing agreement under art. 28 GDPR (large services offer a standard DPA you simply accept).
• Transfers to the US. The EU decision on the Data Privacy Framework is in force: the EU General Court dismissed the action against it on 3 September 2025, and the appeal has not been decided yet. A US service should be on the DPF list or work under the EU standard contractual clauses. In 2024 the Commissioner, on three complaints about Google Analytics and Facebook on Cypriot sites, issued a reprimand and required transfers on exactly these grounds.

A request from a person about their data (what you hold, delete it, correct it) is answered within one month; this can be extended by two more months, but the extension and the reason must be communicated within the first month (art. 12(3) GDPR).

Records of processing and breaches: where Cyprus adds criminal liability

Many believe that records of processing (art. 30 GDPR) are only for companies with 250 staff or more. The small-company exemption does not apply if processing is not occasional — and a site with enquiry forms, a newsletter or analytics processes data continuously. The Commissioner stresses that the three conditions of the exemption are alternatives: one is enough. The records are not sent to the Commissioner but produced on request; an Excel template is on the Commissioner’s site.

The Cypriot twist is art. 33 of Law 125(I)/2018: failing to keep records where they are required, failing to notify the Commissioner of a breach or failing to warn people when the risk is high is a criminal offence, punishable by up to 3 years in prison or a fine of up to €30,000, and the company’s top management is liable too. This comes on top of GDPR administrative fines: up to €10m or 2% of worldwide turnover, and up to €20m or 4%, depending on the breach.

A breach (a hack, a leaked enquiry database, a client list emailed to the wrong person) is reported to the Commissioner within 72 hours of becoming aware of it, if it may harm people. There is no online form: you fill in the Excel form from the Commissioner’s site and email it to commissioner@dataprotection.gov.cy. So it pays to know in advance where the logs are and who handles security at your vendors — 72 hours is too late to find out.

A data protection officer (DPO) is not mandatory for everyone: only for public bodies and for those whose core activity is regular, large-scale monitoring of people or large-scale processing of special categories of data (health, criminal records). If you appoint a DPO, send their name, email and phone to the Commissioner by letter or email.

Newsletters and SMS

Marketing emails and SMS to individuals need prior consent (art. 106(1) of Law 112(I)/2004). The exception is your own customers: if you got the email address when selling a product or service, you may offer your own similar products, provided the customer can opt out free and easily — both when the address is collected and in every message (art. 106(2)). Hiding the sender or sending without a working address for unsubscribing is prohibited.

Fines here are small but frequent: Mediacube Worldwide Ltd — €3,500 for marketing emails without consent and an ignored unsubscribe request (2023), the CYspots site — €800 for a newsletter without consent, IKEA and European University — €500 each for SMS without a free way to opt out (2018).

Online shops: returns, buttons and what changed in 2025–2026

Buyers’ rights in Cyprus are now in the Consumer Protection Law 112(I)/2021 — the former law 133(I)/2013 has been repealed, and texts citing it are out of date.

• 14 days to withdraw from a purchase without giving reasons (art. 20). If the shop did not inform the buyer of this right, the period is extended by 12 months (art. 21).
• At the latest when ordering begins, the site states whether there are delivery restrictions and which payment methods are accepted (art. 19(3)).
• From 19 June 2026 — a withdrawal function (art. 22Α, added by Law 30(I)/2026). Where a contract is concluded on a website or app, there must be a prominent function labelled “Πατήστε εδώ για υπαναχώρηση” (“Click here to withdraw”) or equally clear wording, available for the whole withdrawal period. The form asks for the name, the contract and how to receive confirmation; the confirm button reads “επιβεβαίωση υπαναχώρησης” (“confirm withdrawal”). Receipt is confirmed to the buyer without delay on a durable medium, such as an email. It applies to all online consumer contracts, not only financial services.
• The order button. From 27.09.2026 Law 122(I)/2026 removed from the Cypriot text the requirement to label the button “order with obligation to pay”. The EU Directive 2011/83 (art. 8(2)) still contains it, and courts read national law in line with the directive — so we would keep a label such as “Order with obligation to pay”.
• The link to the EU ODR platform can go: the regulation was repealed from 20 July 2025 and the platform is closed. A notice about alternative dispute resolution is needed only if the shop has committed to, or is obliged to use, such a body (art. 14 of Law 85(I)/2017).

For breaches the Consumer Protection Service can impose up to 5% of last year’s turnover (up to €3m if turnover is unknown) and up to €5,000 for each day the breach continues (art. 57).

Accessibility for people with disabilities

Since 28 June 2025 Cyprus applies Law 57(I)/2024, which transposes the European Accessibility Act. It covers consumer services: online shops and any online service where a contract is concluded, banking, e-books and passenger transport websites. The site must be usable by people with visual, hearing and motor impairments. The law lists the requirements in an annex; the practical benchmark is the EN 301 549 standard (WCAG 2.1 AA), which public-sector sites are tested against too: contrast, image descriptions, keyboard operation, clear forms.

Microenterprises providing services are exempt: fewer than 10 staff and turnover or balance sheet of no more than €2m. Services lawfully in use before 28.06.2025 may continue until 28.06.2030. Enforcement lies with the Deputy Minister of Social Welfare; fines reach €10,000, €20,000 for a repeat, and up to €500 per day of continued breach.

Chatbots and AI-written texts

Since 2 August 2026 art. 50 of the EU AI Act applies. People must know they are talking to an AI unless it is obvious — the duty lies directly on the system’s provider, but if a bot sits on your site posing as a sales manager, it is sensible to label it yourself. Whoever publishes AI-generated text “with the purpose of informing the public on matters of public interest” must disclose it, unless the text has undergone human review or editorial control with an editor taking responsibility; deepfakes (image, audio, video) are always labelled. Sales pages and product descriptions fall outside this rule.

Checklist for a company website

• In the footer: name, registration number, company type, registered office, address, email, VAT number.
• A cookie banner with equal “Accept” and “Reject” buttons; analytics and pixels load only after consent; a “Cookie settings” link on every page.
• A privacy notice meeting art. 13 GDPR, linked under every form.
• Forms without unnecessary fields; consent boxes not pre-ticked.
• Data processing agreements (DPA) with hosting, CRM, email service and chat; US services under the DPF or EU standard clauses.
• Records of processing — even in a small company.
• A breach plan: who decides, where the logs are, the Commissioner’s form, 72 hours.
• Newsletters with consent, or to your own customers about similar products, with an unsubscribe link in every message.
• For a shop: information on the 14 days, the “Πατήστε εδώ για υπαναχώρηση” withdrawal function, a labelled order button, no ODR link.
• For a shop or online service larger than a microenterprise — accessibility (benchmark: EN 301 549).
• An AI chatbot labelled as AI.

Sources

• GDPR, Regulation (EU) 2016/679 — arts 6, 8, 12, 13, 28, 30, 33, 37, 83.
• Law 125(I)/2018 on personal data protection — art. 8 (age 14), art. 33 (criminal liability).
• Law 112(I)/2004 on electronic communications — art. 99(5) (cookies), art. 106 (marketing), art. 107Β (fines).
• Data Protection Commissioner: cookies — the authority’s position on banners and analytics.
• Commissioner: breach notification — the form and how to submit it.
• Companies Law, Cap. 113 — art. 103(1Α).
• Law 156(I)/2004 on e-commerce — arts 8–14.
• Consumer Protection Law 112(I)/2021 — arts 19–22Α, 57.
• Law 57(I)/2024 on accessibility of products and services.
• AI Act, Regulation (EU) 2024/1689 — art. 50.