Law note · Cyprus
GDPR Article 22 and Law 125(I)/2018, Automated Decisions in Cyprus
cite Regulation (EU) 2016/679, Art. 22; Law 125(I)/2018
stage In effect
since 2018-07-31
reviewed 2026-08-24
General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing, restated by Law 125(I)/2018 without narrowing per its own summary. No Cyprus-specific broadening of data-subject rights beyond the GDPR baseline was identified in this pass.
What it asks of an app
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Cyprus within one month of receipt.
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Cyprus, under General Data Protection Regulation (GDPR) Article 22.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679