GDPR for Cyprus Business Websites: A Practical Checklist

This page is general information and not legal advice. A Cyprus lawyer should review your privacy notice and consent set-up before launch.

What does the Cyprus regulator actually enforce?

The Commissioner for Personal Data Protection supervises the GDPR in Cyprus. In May 2024, press coverage of the Commissioner's six-year figures reported 2,585 complaints handled and 299 decisions with total fines of EUR 1.561 million. That is about EUR 5,200 per decision if every decision carried a fine, which the report does not say, and a few large fines distort any average. Our arithmetic is only a rough guide.

Notice what people complain about: 746 of the 2,585 complaints, about 29%, concerned unsolicited advertising messages. For a website owner that points to email and SMS marketing as the area to get right first.

The legal ceiling is far higher. Article 83 allows fines of up to EUR 20 million or 4% of worldwide annual turnover for the most serious breaches, and up to EUR 10 million or 2% for the lower tier.

1. Map the data before writing anything

List every place the site collects or receives personal data: contact forms, newsletter sign-ups, booking forms, checkout, live chat, analytics, advertising tags, maps, embedded videos and the email inbox that receives it all. For each, note what data, why, who sees it and how long you keep it. The privacy notice, cookie banner and vendor contracts all come from this list.

2. Write a privacy notice that matches the list

When you collect data directly from people, Article 13 requires you to tell them:

• who you are and how to contact you, plus a data protection officer if you have one
• why you use the data and the legal basis, and any legitimate interest you rely on
• who receives it, and any transfer outside the EU with the safeguards used
• how long you keep it
• their rights to access, correct, erase, restrict, object and port their data
• the right to withdraw consent, where you rely on consent
• the right to complain to the supervisory authority, in Cyprus the Commissioner
• whether providing the data is required, and any automated decisions

Link the notice from every form, in the language of the page. Keep it in plain language.

3. Cookies and tracking: consent first

Cookie rules sit in the EU's ePrivacy framework, applied through Cypriot law, alongside the GDPR. The Cyprus Commissioner has issued guidance on cookies, and a 2026 update from the law firm VLO describes it as aligning Cyprus with approaches taken by the French and Irish regulators. Zeno Legal's October 2026 summary of that guidance says:

• Non-essential tools, including analytics, wait for consent. Scrolling, continuing to browse or closing the banner is not consent.
• Optional categories start switched off.
• Accepting and rejecting should take the same number of actions at the same level, and withdrawal should be as easy as consent.
• Design should not steer the choice, for example through different font sizes.
• The "strictly necessary" exemption is narrow. Measuring performance or marketing does not qualify.
• The detailed notice should name the actual cookies, purposes, durations and third parties.

Test your banner by opening the site in a private window and checking, before you click anything, that no optional tag has fired.

4. Forms and email marketing

• Ask only for what you need. A phone number on a general enquiry form is often unnecessary.
• Never pre-tick a box for marketing. Keep consent separate from accepting terms.
• Tell people what happens next: who replies and when.
• Send marketing email only to people who have opted in or are covered by a clear lawful route, and include a working unsubscribe link in every message. Given the complaint numbers above, treat this as a priority.

5. Vendors and processor contracts

Your host, email platform, analytics tool, CRM, booking system and payment provider handle personal data for you. Article 28 requires a binding contract with each processor. It must cover processing only on your documented instructions, confidentiality, security measures, controls over sub-processors, help with people's requests and breaches, deletion or return of data at the end, and audit rights.

Most large vendors publish a standard data processing agreement. Accept it, save a copy, and note any transfers outside the EU. Check that a freelancer or agency who has access to your site or inbox has signed something equivalent.

6. Requests, breaches and records

• Requests from individuals. Respond without undue delay and within one month. You may extend by two more months for complex cases and must explain within the first month. Information is normally free.
• Breaches. Notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights. If you are late, explain why.
• Records. Keep a short log of requests and incidents, with dates and what you did.

A one-page launch check

• Data map done and dated
• Privacy notice linked from every form
• Cookie banner blocks optional tags until consent
• Reject is as easy as accept; withdrawal is available
• Marketing consent is separate and not pre-ticked
• Processor agreements saved for host, email, analytics and CRM
• Someone named to handle requests and breaches
• A Cyprus lawyer has reviewed the notice and banner

Selling products or taking bookings? Our guide to selling online in Cyprus covers payments and VAT. If your site uses an AI chatbot or automation, read AI for small business first, since those tools process personal data too. Your Google Business Profile also publishes your contact details, so keep them current. We can build the site side of this on request through our web design service.