DORA ICT supplier contracts in Cyprus: Article 30 checklist

Identify the regulated entity, ICT service and supported function

Start with the legal entity buying the service. DORA applies to the financial entities listed in Article 2, subject to its exclusions and proportionality provisions; a Cyprus investment firm, fund manager or other regulated business should check its exact category rather than assuming that every group company has the same obligations. The contract review is about ICT services supplied by an ICT third-party service provider. A professional adviser using software internally is not automatically the financial entity's ICT supplier. Record the direct provider, contracting entity, service owner and operational use before marking a purchase order as DORA relevant.

Map the business function that depends on the service, not merely the technology label. Ask what fails if a payment gateway, trading platform, cloud host, identity service or backup provider is unavailable, corrupted or inaccessible. DORA's definition of a critical or important function concerns disruption that would materially impair the entity's financial performance, continuity of services and activities, or continued compliance with authorisation conditions and financial-services obligations. A system can be important because it supports a regulated activity even if its subscription cost is small. Document the function, impact scenario, alternative capacity and classification decision.

Classification controls the depth of the contract, the pre-contract risk review and the exit plan. Do not copy the same enhanced schedule into every minor contract without checking whether the terms are workable, but do not omit Article 30(2)'s baseline provisions because a supplier is labelled non-critical. Where one provider supports several functions, assess each dependency and record the combined risk. Revisit classification when usage expands, an additional group entity joins, volumes rise or a once-optional platform becomes the only route for clients. Keep the approved decision alongside the signed agreement and its amendments.

For the separate authorisation question, see the Cyprus investment-firm licensing guide.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; CySEC Circular C751 (19 January 2026): DORA reporting, register format and portal obligations; EBA: preparation for DORA register of information reporting

Complete the Article 28 decision before signature

Article 28 keeps responsibility with the financial entity even when it buys the technology. Before entering an ICT arrangement, the entity should assess whether the service supports a critical or important function, whether supervisory conditions for contracting are met, and all relevant risks, including ICT concentration. It should undertake due diligence on a prospective provider and identify conflicts of interest. Treat these as decision steps with evidence, not a questionnaire filed after procurement has finished. The contract owner should be able to explain why the chosen provider can support the entity's service, security and recovery requirements.

Review concentration at more than brand level. Two apparent vendors may rely on one cloud infrastructure, shared group ownership or the same subcontractor for a critical component. Compare regions, data centres, privileged-access arrangements and substitutability. If the service is critical or important and the provider is established in a third country, Article 29 adds consideration of EU data-protection compliance and effective enforcement of law there. Where subcontracting is possible, assess whether a long or complex chain prevents the entity from monitoring the service or the competent authority from supervising it effectively.

A useful approval file states the service and function, classification, due-diligence findings, security standards, alternatives, concentration exposure, proposed subcontracting chain, residual risks and approving body. Connect each material finding to a contractual control or a documented reason for accepting a gap. The entity's management body remains responsible for its ICT risk framework; the supplier's assurance certificate does not transfer that responsibility. Set a renewal trigger so the decision is revisited when the supplier changes a location or material subcontractor, not only on the anniversary date.

Where personal data is processed on the entity's instructions, align this review with the GDPR processor-agreement guide.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; Commission Delegated Regulation (EU) 2025/532 on subcontracting ICT services supporting critical or important functions; Commission Delegated Regulation (EU) 2024/1773 on the policy for ICT services supporting critical or important functions

Check every Article 30(2) clause for all ICT arrangements

Article 30(1) requires clearly allocated rights and obligations in writing, with the full contract and service-level agreements available in one paper or downloadable, durable and accessible document. For every in-scope ICT arrangement, Article 30(2) calls for a complete description of functions and services; permitted subcontracting of critical or important services and its conditions; the regions or countries of service delivery and data processing, including storage; and advance notice of location changes. An undefined phrase such as 'any global data centre' may defeat the location review. The contract should let operations staff identify where the actual service runs.

The baseline also covers availability, authenticity, integrity and confidentiality of data; access, recovery and return of personal and non-personal data in an easily accessible format after insolvency, resolution, discontinuation or termination; service-level descriptions; and incident assistance without additional cost or at a cost fixed in advance. Review the data-return clause against a real migration: format, timing, authentication, backup copies and a contact able to act during supplier distress. A right that only becomes usable after the supplier has stopped operating is weak practical protection even when its heading resembles Article 30.

Finally, check cooperation with the entity's competent and resolution authorities, termination rights and associated minimum notice periods, and the conditions for the supplier's participation in the entity's ICT-security awareness and digital-resilience training. These terms should coexist coherently with payment, liability and confidentiality provisions. A broad confidentiality clause must not block lawful supervisory cooperation. A fee schedule that leaves incident assistance unpriced does not meet the requirement for no extra charge or a predetermined cost. Compare the executed order form, master agreement, schedule and incorporated policies as one contractual package.

Review international personal-data transfers separately under the Cyprus GDPR transfer guide.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30

Add Article 30(3) controls for critical or important functions

When the service supports a critical or important function, Article 30(3) requires more than a generic uptime promise. The service levels need precise quantitative and qualitative performance targets, updates and revisions that let the entity monitor performance and seek timely correction. Define the metric, measurement period, exclusions, reporting feed, threshold and escalation owner. A 99.9 percent availability figure with no measurement rule can hide a failure during the entity's trading window. Match targets to the actual function and to the business-continuity assumptions used in the entity's own risk assessment.

The enhanced contract must provide notice periods and reporting obligations for developments that might materially affect delivery. It must require the supplier to implement and test business-contingency plans and appropriate ICT-security measures. It must address the supplier's participation and full cooperation in the entity's threat-led penetration testing where applicable. These obligations need an operational protocol: whom to notify, what information to supply, how evidence is protected, who approves testing and how a discovered weakness is corrected. A promise to 'cooperate where commercially reasonable' may be too uncertain for an event that affects a regulated function.

Include ongoing monitoring and the Article 30(3)(e) rights of access, inspection and audit by the entity or appointed third party, as well as rights for the competent authority and cooperation during inspections. The same provision has a specific microenterprise derogation for delegating the entity's audit rights to an independent third party; check whether it actually applies before using it. Article 30 also requires an exit strategy with an adequate mandatory transition period for continued service while moving to another provider or in-house solution. Test whether liability caps, termination fees or IP restrictions make the promised audit or exit right unusable. The enhanced layer follows the function supported, not formal designation of a critical provider under DORA's separate oversight framework.

A digital-asset firm should separately verify the sector-specific route in the Cyprus MiCA licensing guide.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; Commission Delegated Regulation (EU) 2024/1773 on the policy for ICT services supporting critical or important functions

Control the subcontracting chain instead of accepting a blank cheque

Article 30 requires the agreement to say whether subcontracting a critical or important ICT service, or material parts of it, is permitted and on what conditions. Ask the supplier to identify the functions each subcontractor performs, where they and the relevant data are located, and what access they have. A blanket permission to use any affiliate or subcontractor at any time leaves the entity unable to assess concentration, security, supervision or exit. At the same time, a static list without change notice will quickly become inaccurate. Specify the approval or objection process and the information needed for a meaningful decision.

Commission Delegated Regulation (EU) 2025/532 adds detailed standards for subcontracting ICT services supporting critical or important functions. The entity should assess the service and provider before permitting subcontracting and check whether the contract gives it a practical right to monitor the chain and respond to changes. Flow down relevant security, continuity, service-level, reporting and access requirements so a direct supplier cannot promise control it cannot obtain from the next tier. Evaluate third-country location and insolvency issues where relevant. The assessment should reflect the actual chain, rather than merely attaching a supplier's general subprocessor webpage.

Build a change workflow for a proposed new subcontractor or a material change in scope. Identify who receives notice, how long there is to review, what evidence can be requested and which risk decisions need escalation. Align the contract's objection and termination rights with the technical ability to migrate. If the supplier will not reveal a material dependency, document the limitation and decide whether the entity can lawfully and safely use the service. GDPR processor-subprocessor approval may be required as well, but GDPR and DORA solve different problems; one subprocessor clause does not automatically satisfy both regimes.

For personal-data processing terms, use the separate Article 28 GDPR contract checklist.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; Commission Delegated Regulation (EU) 2025/532 on subcontracting ICT services supporting critical or important functions; Regulation (EU) 2016/679, GDPR, Article 28 and Chapter V

Keep the ICT register aligned with the signed contract

Article 28(3) requires a current register of information covering all contractual arrangements for ICT services provided by ICT third-party providers, at entity, sub-consolidated and consolidated levels as applicable. The register is not limited to critical functions. The entity must also inform its competent authority in a timely manner about a planned arrangement supporting a critical or important function, or when a function becomes critical or important. The register should match the executed contract, named provider, service, supported function and group structure. Record amendments and termination so a regulator does not receive a stale supplier map. Implementing Regulation (EU) 2024/2956 prescribes the templates; use its fields rather than inventing an incompatible spreadsheet.

CySEC Circular C751 of 19 January 2026 confirms annual register submission by 28 February with a 31 December reference date for its listed regulated entities. It also says the earlier Build in Excel route has been discontinued: the register must be prepared in XBRL-CSV, validated with compatible software, compressed and submitted through CySEC's XBRL Portal. Do not use the first-submission exception from 2025 as a recurring deadline or assume an ordinary spreadsheet upload will be accepted. Check the current CySEC instruction for the relevant sector and reporting year. The entity must also report at least yearly on new ICT arrangements and the categories of providers, contracts, services and functions. Procurement, risk and IT need one consistent inventory to produce these fields.

Set a control that compares the register against accounts payable, procurement approvals, cloud accounts and the contract repository. Resolve mismatches: a new SaaS account may be an ICT arrangement although no formal master agreement was filed; an old vendor may remain in the register after migration. The EBA's public register material makes clear that this information serves supervisory oversight and identification of critical ICT providers. Give a named owner responsibility for identifier quality and group mapping. The contract file should point to the register entry and the register should point back to the governing signed documents.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; Commission Implementing Regulation (EU) 2024/2956 on register of information templates; CySEC Circular C751 (19 January 2026): DORA reporting, register format and portal obligations; EBA: preparation for DORA register of information reporting

Test exit, data recovery and overlapping legal duties

An exit clause should answer a practical question: can the financial entity continue the regulated function if the supplier deteriorates, fails or refuses renewal? Identify trigger events, decision owner, notice, mandatory transition service, data format, export route, assistance cost and the destination for the service. For a critical function, run a tabletop exercise using the contract's actual time periods and technical dependencies. A right to terminate immediately may be counterproductive if the only copy of the data is still with the provider. Conversely, a long notice period without a risk-triggered exit may trap the entity after serious security failings.

DORA Article 28(7) identifies termination scenarios including significant breaches, circumstances that could alter performance, weaknesses in ICT-risk management and inability of the competent authority to supervise effectively. Contract remedies should allow the entity to act in those circumstances. Check whether source materials, configuration, credentials and documentation can be retrieved and whether data is actually readable by a replacement provider. Treat backups and deletion separately: the entity may need prompt recovery for continuity while also controlling personal-data retention. Test a failed export before claiming that an exit plan is operational.

DORA does not displace GDPR. Where the supplier processes personal data on instructions, the Article 28 GDPR agreement needs its own subject matter, purposes, security, subprocessor and return-or-delete terms. Where data leaves the EEA, assess the GDPR transfer mechanism and any supplementary measures separately. Sectoral outsourcing rules and confidentiality obligations may add further conditions. Build a clause map showing which term meets which obligation; do not assume a single label such as 'DORA addendum' cures a contradiction in a master contract. Record unresolved gaps, decision-maker and remediation date before the service is relied on.

For the privacy-law layer, consult the international-transfer guide.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; Regulation (EU) 2016/679, GDPR, Article 28 and Chapter V; Commission Delegated Regulation (EU) 2024/1773 on the policy for ICT services supporting critical or important functions

Run a documented review in the order the risk arises

First, inventory the actual ICT service and contracting entities; classify every supported function; and complete the Article 28 pre-contract assessment. Second, mark up the contract against Article 30(2) and, if the function is critical or important, Article 30(3) and the relevant technical standards. Third, verify the operational claims with the service team: location list, measured service levels, incident contacts, audit evidence and export method. A legal checkbox should not be signed off before the people who would invoke the right confirm that the process can be used.

Fourth, reconcile the final signed documents with the register of information and the applicable CySEC reporting instructions. Fifth, schedule periodic monitoring and event-driven review: a new subcontractor, geographic move, outage, material service change or regulatory finding should reopen the relevant assessment. Maintain a dated clause matrix that cites the signed document and section number, the responsible owner and any accepted gap. This creates a trail that supports supervision and avoids repeating a full contract reconstruction during an incident.

A final test is to simulate three calls: an outage, a supervisory request for access, and a supplier exit. Can the entity identify the responsible person, obtain evidence, direct the supplier and retrieve the necessary data within the contractual and operational time available? If any answer depends on a supplier favour rather than an enforceable, usable term, revise the agreement or the service design. Recheck primary law and current CySEC communications before signing a new template, since subordinate standards and reporting procedures can change after the original DORA regulation was adopted.

Basis and guidance: Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30; CySEC Circular C751 (19 January 2026): DORA reporting, register format and portal obligations; Commission Delegated Regulation (EU) 2025/532 on subcontracting ICT services supporting critical or important functions; Commission Implementing Regulation (EU) 2024/2956 on register of information templates

Primary sources and scope

Sources checked: October 7, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) 2022/2554, DORA, Articles 2 and 28–30
• Commission Delegated Regulation (EU) 2025/532 on subcontracting ICT services supporting critical or important functions
• Commission Delegated Regulation (EU) 2024/1773 on the policy for ICT services supporting critical or important functions
• Commission Implementing Regulation (EU) 2024/2956 on register of information templates
• CySEC Circular C751 (19 January 2026): DORA reporting, register format and portal obligations
• EBA: preparation for DORA register of information reporting
• Regulation (EU) 2016/679, GDPR, Article 28 and Chapter V