Misuse of your personal data: GDPR rights in Cyprus
In Cyprus, the GDPR is implemented and supplemented by Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data. If your personal data is being misused - processed without a lawful basis, kept too long, or shared without your consent - you have rights including access, rectification and erasure, and you can complain to the Office of the Commissioner for Personal Data Protection.
Key facts
What to do
- Identify who controls your data and exactly what is being processed and why.
- Send the controller a written request exercising your rights (access, rectification, erasure or objection).
- Ask for erasure (the right to be forgotten) where the data is no longer needed or was processed unlawfully.
- Keep copies of your request and note the deadline for the controller to respond.
- If the controller does not respond properly, lodge a complaint with the Commissioner for Personal Data Protection.
- Keep records of any damage caused, in case you pursue compensation.
What to watch out for
- Vague requests slow the process - state clearly which right you are exercising and identify the data.
- Some rights, including erasure, are not absolute and can be limited by other legal obligations.
- Delay can make it harder to trace how the data was misused - act while records still exist.
- Complaining to the Commissioner has its own procedure; keep documentary evidence throughout.
Legal basis
Frequently asked questions
Can I demand that a company deletes my data?
You can exercise the right to erasure under the GDPR and Law 125(I)/2018. It applies in defined situations and is not absolute - some data may have to be kept for other legal reasons.
Who do I complain to about misuse of my data?
You can lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus, which supervises data protection under the GDPR and Law 125(I)/2018.
Can I get compensation?
Where unlawful processing has caused you damage, the data protection framework allows for compensation. Keep evidence of the misuse and of any harm suffered.