Misuse of your personal data: GDPR rights in Cyprus

In Cyprus, the GDPR is implemented and supplemented by Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data. If your personal data is being misused - processed without a lawful basis, kept too long, or shared without your consent - you have rights including access, rectification and erasure, and you can complain to the Office of the Commissioner for Personal Data Protection.

✅ What to do

1. Identify who controls your data and exactly what is being processed and why.
2. Send the controller a written request exercising your rights (access, rectification, erasure or objection).
3. Ask for erasure (the right to be forgotten) where the data is no longer needed or was processed unlawfully.
4. Keep copies of your request and note the deadline for the controller to respond.
5. If the controller does not respond properly, lodge a complaint with the Commissioner for Personal Data Protection.
6. Keep records of any damage caused, in case you pursue compensation.

⚠️ What to watch out for

• Vague requests slow the process - state clearly which right you are exercising and identify the data.
• Some rights, including erasure, are not absolute and can be limited by other legal obligations.
• Delay can make it harder to trace how the data was misused - act while records still exist.
• Complaining to the Commissioner has its own procedure; keep documentary evidence throughout.

⚖️ Legal basis

❓ Frequently asked questions