Cybersecurity law & regulation in Cyprus (2026)

Legal framework

Network and Information Systems Security (Amendment) Law of 2025, Law 60(I)/2025 (amending Law 89(I)/2020); supervised by the Digital Security Authority (DSA) and CSIRT-CY under EU NIS2 Directive 2022/2555

NIS2 & cybersecurity law in Cyprus

In Cyprus, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Cyprus implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Cyprus

1. 01Transposing legislation

   Law 60(I)/2025 (Security of Networks and Information Systems (Amendment) Law of 2025), enacted 10 April 2025 and in force from 25 April 2025, aligns Cyprus national law with EU NIS2 Directive 2022/2555; it amends the baseline Law 89(I)/2020.

   harneys.com digital-strategy.ec.europa.eu

2. 02Competent authorities

   The Digital Security Authority (DSA) is the national NIS supervisory and regulatory body; the National CSIRT (CSIRT-CY), embedded within the DSA, handles incident management, coordination and response for critical infrastructure operators. The DSA was also designated as Cyprus's AI Act Market Surveillance Authority in January 2025.

   dsa.cy legal500.com

3. 03Scope expansion

   The law categorises covered entities as 'essential' or 'important' based on a size-cap rule (medium and large enterprises in Annex I/II sectors: energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, public administration, space, etc.). Approximately ten times more organisations are in scope compared to NIS1, which covered only 70 entities; size criteria are waived for trust service providers, cloud services and data centres.

   harneys.com nis2certification.eu

4. 04Incident reporting duties

   Entities must submit an early warning to DSA/CSIRT-CY within 6 hours of becoming aware of a significant incident, a full incident notification within 72 hours, and a final report within one month. Significant incidents are those causing or capable of causing severe operational disruption or financial loss.

   harneys.com ezine.eversheds-sutherland.com

5. 05Penalties

   Administrative fines for essential entities can reach €10 million or 2% of total global annual turnover (whichever is higher); for important entities the cap is €7 million or 1.4% of global annual turnover. Management bodies can be held personally liable for persistent non-compliance.

   harneys.com kyprianou.com

6. 06GDPR data-breach overlay

   Separate from NIS2, Cyprus's Commissioner for Personal Data Protection enforces GDPR (Regulation 2016/679) breach notification: personal-data breaches must be notified to the Commissioner within 72 hours and to affected individuals without undue delay where high risk arises. Both regimes apply concurrently for incidents involving personal data.

   dlapiperdataprotection.com dataguidance.com

NIS2 in Cyprus: FAQ

Timeline of decisions

1. 7 May 2025Enforcement · official
   European Commission Issues Reasoned Opinion Against Cyprus for NIS2 Non-Transposition

   The Commission escalated infringement proceedings against Cyprus and 18 other Member States for failing to fully notify transposition of the NIS2 Directive; Cyprus faces referral to the EU Court of Justice if it does not comply within two months, even though it had already enacted its implementing law weeks earlier.

   European Commission – Digital Strategy

2. 25 Apr 2025Law
   NIS2 Directive Transposed: Network and Information Systems Security (Amendment) Law 2025

   Parliament enacted the NIS2 implementation law on 10 April 2025, published on 25 April 2025, amending Law 89(I)/2020 and extending mandatory cybersecurity obligations to 'essential' and 'important' entities across ten critical sectors — expanding coverage from roughly 70 to approximately 700 entities. The Digital Security Authority remains the national competent authority.

   Harneys

3. 25 Apr 2025Law
   Cyprus transposes NIS2 Directive — Network and Information Systems Security (Amendment) Law 2025

   Parliament enacted the NIS2 transposition law, extending mandatory cybersecurity obligations to a broader set of 'essential' and 'important' entities, imposing 6-hour initial incident-notification deadlines, and making top management personally accountable for cybersecurity governance. The Digital Security Authority gained enhanced fine-setting powers, creating a tighter regulatory perimeter around organisations that process personal data at scale.

   Harneys (law firm briefing on NIS2 Amendment Law 2025)

4. 25 Apr 2025Law · official
   Cyprus Enacts NIS2 Transposing Law 60(I)/2025

   The Network and Information Systems Security (Amendment) Law of 2025, Law 60(I)/2025, entered into force, transposing EU Directive 2022/2555 (NIS2) and expanding cybersecurity obligations to a broader set of 'essential' and 'important' entities, with administrative fines up to €10 million or 2% of global annual turnover.

   European Commission – Digital Strategy

5. 20 Mar 2025Decision
   Cyprus Allocates €8.5 Million to Strengthen National Cybersecurity

   The Cypriot government approved an €8.5 million cybersecurity investment to upgrade defences for public infrastructure, following a documented 45% rise in attempted network breaches between 2023 and 2024 and recurring attacks on critical infrastructure.

   Cyprus Mail

6. 1 Oct 2024Incident
   Wave of Cyberattacks Hits Cyprus Critical Infrastructure

   A series of coordinated cyber attacks targeted Cyprus government websites, public utilities, and private businesses, with six significant incidents recorded in a short window; eleven critical infrastructure operators subsequently received emergency cyber-defence upgrades, and the Digital Security Authority briefed parliament on heightened geopolitical threat levels.

   Industrial Cyber

7. 1 Dec 2022Incident
   Cyberattack Targets Cyprus Ministry of Defence

   A targeted intrusion into Ministry of Defence systems sought to exfiltrate sensitive documents and compromise military infrastructure, becoming one of the most serious state-sector cyber incidents in Cyprus's modern history and highlighting gaps in government network defences.

   Fast Forward Cyprus

8. 12 Aug 2020Law
   Cyprus Fully Transposes NIS Directive: Law 89(I)/2020 Enters Force

   Law 89(I)/2020 replaced the interim 2018 NIS legislation and completed Cyprus's full transposition of EU NIS Directive 2016/1148, granting the Digital Security Authority comprehensive supervisory powers over operators of essential services, digital service providers, and electronic communications providers, with fines up to €200,000.

   Antoniou McCollum & Co.

9. 1 Jan 2020Law · official
   Security of Networks and Information Systems Law 89(I)/2020 (NIS1 Transposition)

   Cyprus enacted Law 89(I)/2020 implementing the EU NIS Directive, establishing the Digital Security Authority as the national competent cybersecurity authority and creating mandatory security and incident-reporting obligations for operators of essential services and digital service providers, covering infrastructure underlying online services.

   ENISA — Cyprus National Cybersecurity Strategy 2020

10. 1 Jan 2020Guidance · official
    Cyprus National Cybersecurity Strategy 2020 Published

    The Digital Security Authority published Cyprus's second National Cybersecurity Strategy, revising the 2013 framework with updated priorities around protecting critical information infrastructure, strengthening CSIRT-CY capabilities, and positioning Cyprus as a regional cybersecurity leader.

    Digital Security Authority (DSA) – Cyprus

11. 1 Jan 2018Law · official
    Digital Security Authority Established by Law 17(I)/2018

    Law 17(I)/2018 created the Digital Security Authority (DSA) as Cyprus's national competent authority and single point of contact for NIS Directive implementation, consolidating cybersecurity governance previously fragmented across the electronic communications regulator, and formally incorporating the national CSIRT (CSIRT-CY).

    Digital Security Authority (DSA) – Cyprus

12. 1 Jan 2015Law · official
    Law 147(I)/2015: Criminalising Attacks Against Information Systems

    Cyprus enacted Law 147(I)/2015 transposing EU Directive 2013/40/EU on attacks against information systems, introducing criminal sanctions for illegal system access, data interference, and interception — strengthening the cybercrime criminal law framework beyond the earlier Budapest Convention ratification and covering online platforms and services.

    Council of Europe — Octopus Cybercrime Community

Sources

1. 1.harneys.com/our-blogs/regulatory/cyprus-adopts-nis2-directive-key-updates-in-2025
2. 2.digital-strategy.ec.europa.eu/en/policies/nis2-directive-cyprus
3. 3.digital-strategy.ec.europa.eu/en/policies/nis-transposition
4. 4.dsa.cy/en/
5. 5.ezine.eversheds-sutherland.com/eu-nis2-directive/cyprus
6. 6.ecs-org.eu/activities/nis2-directive-transposition-tracker/
7. 7.kyprianou.com/nis2-requirements-in-cyprus-navigating-the-compliance-requirements-an
8. 8.dlapiperdataprotection.com/index.html?t=breach-notification&c=CY
9. 9.legal500.com/guides/chapter/cyprus-data-protection-cybersecurity/
10. 10.nis2certification.eu/cyprus/
11. 11.dataguidance.com/notes/cyprus-data-protection-overview