A company website in Cyprus: what the law requires — data, cookies, marketing and online sales

In short

Who it applies to

Company owners and the self-employed whose business has a website: a brochure site with an enquiry form, a newsletter, an online shop or an online service.

What it costs

There is nothing to register and no fee: neither the site nor the records of processing are registered anywhere. The price of a mistake is fines: up to €200,000 under Cypriot law for cookies and marketing, up to €20m or 4% of turnover under the GDPR, up to 5% of turnover for breaching buyers’ rights.

How long it takes

The deadlines are yours, not the authority’s: a data breach goes to the Commissioner within 72 hours, a person’s request about their data is answered within a month, and an online buyer has 14 days to withdraw.

Where to apply

Data, cookies and marketing — the Data Protection Commissioner (gov.cy/dataprotection). A breach is reported with the Excel form from its site to [email protected]; there is no online form. Sales and returns — the Consumer Protection Service.

If your case differs

A company website must show the name, registration number, company type and registered office, plus the address, email and VAT number. These usually go in the site footer.

Your case

Deadlines and conditions

• a breach is reported to the Commissioner within 72 hoursGDPR art. 33(1): «not later than 72 hours after having become aware of it». Commissioner: the Excel form «υποβάλλεται ηλεκτρονικά με αποστολή στο email: [email protected]».
• a child can consent alone from 14Law 125(Ι)/2018, art. 8(1): «εάν το παιδί είναι τουλάχιστον δεκατεσσάρων (14) ετών». The GDPR default (art. 8(1)) is 16.
• the fine for cookies and marketing is up to €200,000Law 112(Ι)/2004, art. 107Β(1)(ε): «διοικητικό πρόστιμο μέχρι διακόσιες χιλιάδες ευρώ (€200,000)»; arts 99 and 106 are enforced by the Commissioner (art. 107(2)).
• the Commissioner has fined €10,400 for unlawful cookiesCommissioner decisions Oct–Dec 2024 (published 28.03.2025): Aylo Freesites Ltd — €10,400 «για παράνομη χρήση cookies» (plus €48,000 under the GDPR).
• up to 3 years or €30,000 as a criminal offenceLaw 125(Ι)/2018, art. 33(1)(α), (γ), (ε) and 33(2): no records under art. 30, no breach notification — «φυλάκισης που δεν υπερβαίνει τα τρία (3) έτη ή … €30.000»; art. 33(5)(α) — «το ανώτατο εκτελεστικό όργανο» is liable.
• 14 days to withdraw from a purchase without giving reasonsLaw 112(Ι)/2021, art. 20(1): «μέσα σε χρονικό διάστημα δεκατεσσάρων (14) ημερών να υπαναχωρήσει … χωρίς να αναφέρει τους λόγους».
• no information on the right to withdraw — the period grows by 12 monthsLaw 112(Ι)/2021, art. 21(1): if the trader did not inform the buyer of the right of withdrawal, the period is extended by 12 months.
• up to €5,000 for each day the breach continuesLaw 112(Ι)/2021, art. 57(1)(ια) — up to 5% of last year’s turnover, or up to €3,000,000 if unknown; (ιβ) — up to €5,000 for each day the breach continues.
• fewer than 10 staff and turnover or balance sheet up to €2m — no accessibility dutyLaw 57(Ι)/2024, art. 2: «πολύ μικρή επιχείρηση» — «λιγότερους από δέκα (10) εργαζομένους» and turnover or balance sheet up to «€2.000.000»; art. 4(5): such service providers «απαλλάσσονται».

Sources

• GDPR, Regulation (EU) 2016/679eur-lex.europa.euLegal bases (art. 6), information to give (art. 13), one-month reply (art. 12(3)), processor contracts (art. 28), records and the exemption (art. 30), 72 hours (art. 33), fines (art. 83).
• Law 125(Ι)/2018 on the protection of natural persons with regard to the processing of personal datawww.cylaw.orgA child’s consent from 14 (art. 8); criminal liability for missing records and unreported breaches (art. 33).
• Law 112(Ι)/2004 on electronic communications, Part 14www.cylaw.orgCookies — art. 99(5), marketing and the own-customer exception — art. 106, fines up to €200,000 — art. 107Β.
• Data Protection Commissioner: cookieswww.gov.cyAnalytics only with consent; rejecting with the same number of clicks and from the same level; pre-ticked boxes, scrolling and “by continuing” are not consent; no cookie walls.
• Commissioner: personal data breach notificationwww.gov.cyThe Excel form in Greek (English for cross-border processing), sent to [email protected].
• Companies Law, Cap. 113, art. 103www.cylaw.orgArt. 103(1Α): a company website shows the name, registration number, private or public, registered office.
• Law 156(Ι)/2004 on electronic commercewww.cylaw.orgArt. 8: address, email, register and number, VAT number, supervisory authority; prices stating tax and delivery.
• Consumer Protection Law 112(Ι)/2021www.cylaw.org14 days (art. 20), 12-month extension (art. 21), withdrawal function from 19.06.2026 (art. 22Α), fines (art. 57); repeal of 133(Ι)/2013 (art. 74).
• Law 57(Ι)/2024 on accessibility requirements for products and serviceswww.cylaw.orgFrom 28.06.2025 — for e-commerce and other consumer services; microenterprises providing services are exempt (arts 2, 4(5)).
• 62px: GDPR and your company website in Cyprus — a walkthrough with a checklist62px.comA web studio’s walkthrough: how to test a cookie banner in a minute, what forms and the footer need, what to change in a shop in 2026, a checklist.