Data protection and AI in Cyprus
GDPR and AI in Cyprus
In Cyprus, AI that uses personal data is governed by the GDPR, supplemented by Law 125(I)/2018, and supervised by the Commissioner for Personal Data Protection. The rules that matter most for AI are Article 22 on solely automated decisions, the duty to explain the logic of automated decisions in privacy notices, data protection impact assessments for high-risk processing, and 72-hour breach notification. Since January 2025 the Commissioner has a second role as a market surveillance authority under the EU AI Act for high-risk AI in law enforcement, migration and justice, and as one of three fundamental rights authorities.
The legal framework
The General Data Protection Regulation applies directly in Cyprus. Law 125(I)/2018, on the protection of natural persons with regard to the processing of personal data and the free movement of such data, supplements it where the GDPR leaves choices to member states. One example is the age at which a child can consent to online services, which section 8 of the Law sets at 14.
The Commissioner for Personal Data Protection is the supervisory authority. The Commissioner handles complaints, investigates, issues decisions and fines, and represents Cyprus on the European Data Protection Board.
None of this is new for AI. What is new is that AI systems make the GDPR’s existing rules on profiling, automated decisions and risk assessment apply far more often, and that since January 2025 the same Commissioner also has a role under the EU AI Act.
The GDPR rules that bite on AI
Solely automated decisions. GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Such decisions are allowed only where necessary for a contract, authorised by law, or based on explicit consent, and the first and third routes need safeguards. At a minimum these are the right to human intervention, to express a point of view and to contest the decision. An AI system that rejects a loan, an insurance claim or a job application with no meaningful human review sits squarely here.
Explaining the logic. Articles 13 and 14 require privacy notices to say when Article 22 automated decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences. Article 15 gives people the right to the same information on request. In practice, a privacy policy has to describe the automated decisions an organisation’s AI makes in terms a person can follow. Aicura’s Privacy plan reviews a privacy policy against the automated decision-making frameworks for your country and suggests wording.
Impact assessments. Article 35 requires a data protection impact assessment before processing likely to result in a high risk. It names systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. A well-run AI impact assessment covers the same ground and more.
Breach notification. Article 33 requires notification to the Commissioner within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people. Prompt injection that extracts personal data from a chatbot, or training data exposed through model outputs, are breaches in the ordinary sense.
The Commissioner’s role under the EU AI Act
In January 2025 the Council of Ministers gave the Commissioner two roles under the EU AI Act, set out on the Cyprus AI Act governance page.
- Market surveillance authority. For high-risk AI in Annex III point 1 when used for law enforcement, and points 6, 7 and 8, covering law enforcement, migration, asylum and border control, and the administration of justice and democratic processes. This includes prohibited practices under Article 5 in those areas. The Commissioner of Communications is the market surveillance authority for most other AI.
- Fundamental rights authority. Under Article 77, alongside the Ombudsman and the Attorney-General. This lets the Commissioner request documentation about high-risk Annex III systems where it is needed to protect fundamental rights.
For a public body or contractor in those fields, the same office will look at a system under both the GDPR and the AI Act. For everyone else, the Commissioner remains the authority for any AI that processes personal data, whichever body supervises the system under the AI Act.
What organisations in Cyprus should do
- Map the systems. Record every AI system that uses personal data, what it decides or influences, and whether a person genuinely reviews the outcome. An AI system register is the natural home for this.
- Find the Article 22 decisions. For each solely automated decision with significant effects, identify the legal basis and check that human intervention and a route to contest the decision exist in practice.
- Update the privacy notice. Describe the automated decisions and their logic in plain terms, and keep the description in step with the systems.
- Assess before deploying. Run a DPIA, and for high-risk AI Act uses the deployer’s own assessments, before a new system goes live.
- Plan for incidents. Make sure an AI-related breach reaches the people who can notify the Commissioner within 72 hours.
A note on this page
This is Aicura’s summary of how data protection law applies to AI in Cyprus. It is not legal advice. Read the GDPR, Law 125(I)/2018 and the guidance of the Commissioner for Personal Data Protection, and take advice on your own processing.
Common questions
Does Cyprus have its own rules on automated decision-making?
The core rule is GDPR Article 22, which applies directly in Cyprus. Law 125(I)/2018 supplements the GDPR on matters member states may decide for themselves, such as the age of consent for online services, which it sets at 14. It does not replace Article 22.
Who supervises AI that uses personal data in Cyprus?
The Commissioner for Personal Data Protection, as the GDPR supervisory authority. Under the EU AI Act the Commissioner is also a market surveillance authority for high-risk AI in law enforcement, migration and asylum, and the administration of justice and democratic processes, while the Commissioner of Communications supervises most other AI.
Do I need a data protection impact assessment for an AI system?
Often. GDPR Article 35 requires one where processing is likely to result in a high risk, and it names systematic and extensive evaluation of people by automated means, including profiling, that leads to decisions with legal or similarly significant effects. Many AI systems that score, rank or profile people fall within that description.
How fast must an AI-related data breach be reported in Cyprus?
Within 72 hours of becoming aware of it, to the Commissioner for Personal Data Protection, under GDPR Article 33, unless the breach is unlikely to result in a risk to people. An AI system that leaks personal data through its outputs or logs is a personal data breach like any other.
Start with the AI you run.
Find the AI in your organisation, give every system an owner and add assessments and guardrails when the work needs them.