Employee protections in Cyprus

The employment relationship inevitably involves processing a certain amount of employee data — and most countries have strict laws in place to keep that data safe and secure. Read on for everything employers need to know about data protection in Cyprus.

Data protection regulations in Cyprus

Employers in Cyprus should understand the main data protection regulations that apply to their employees. The primary legislation governing data protection in Cyprus includes:​

• The General Data Protection Regulation (GDPR): An EU law which is directly applicable across all EU member states, including Cyprus.​
  
• Cyprus Law 125(I)/2018: A national law supplementing the GDPR, addressing specific areas such as the age of consent for data processing (set at 14 years in Cyprus) and provisions related to data processing in employment contexts. ​
  

The Office of the Commissioner for Personal Data Protection is the independent supervisory authority responsible for monitoring and enforcing data protection laws in Cyprus.

What employers need to know about data protection in Cyprus

Employers in Cyprus should adhere to the following principles to keep their employees’ data safe and ensure compliance with the applicable data protection laws:

• Establish a lawful basis for processing: Under the GDPR, employers must have a specific legal basis for processing employee data. In the context of employment, consent is generally not considered a lawful basis due to the imbalance of power in the relationship.
  
• Maintain transparency: Employers should provide clear and accessible information to employees about how their personal data is collected, used, and stored.
  
• Collect only necessary data: Employers should only collect and process the personal data needed to meet the demands of the employment relationship.
  
• Implement robust data security measures: Employers must ensure that employee data is kept safe by putting in place technical and organisational safeguards to protect personal data against unauthorised access, accidental loss, or destruction.
  
• Establish internal policies and training: It’s important to develop and enforce internal data protection policies and provide regular training to employees to promote a culture of data protection awareness.
  

Depending on the nature of your business and the scope and extent of your data processing activities, you may also be required to:

• Appoint a Data Protection Officer (DPO): If your organisation’s core activities involve regular and systematic monitoring of data subjects on a large scale or processing of special categories of data, appoint a DPO to oversee compliance efforts.​
  
• Conduct regular Data Protection Impact Assessments (DPIAs): For processing activities that are likely to result in high risks to individuals’ rights and freedoms, perform DPIAs to assess and mitigate potential risks.​
  

Employee monitoring and surveillance in Cyprus

Employee monitoring and surveillance is an important facet of data protection and privacy in Cyprus — and there are certain rules that employers must be aware of.

First, monitoring or surveillance methods must be necessary and proportionate. While CCTV recording may be permissible, the focus should be on protecting assets or employee health and safety, not monitoring employee performance or behaviour.

There are also strict limitations on the use of biometric systems such as face recognition or fingerprint scanning. While these can be used for security purposes (e.g. to restrict access to high-security areas), they cannot be used to track attendance or monitor employees’ arrival and departure times.