Cyprus GDPR Data Breach: Notification and Response Guide

Recognise the incident and run two workstreams

A personal-data breach can affect confidentiality, integrity or availability. It is therefore broader than a hacker publishing a customer list. Accidental disclosure, unauthorised alteration or loss of access to personal information can also require assessment. Conversely, a security alert involving no personal data is not automatically a GDPR personal-data breach. Identify the information and people involved before choosing a label.

Run technical containment and privacy assessment in parallel. The technical team may be isolating an account or preserving logs while the privacy lead identifies affected records and assesses consequences for individuals. Neither workstream should wait for the other to produce a final report. Share confirmed facts and clearly marked uncertainties through one restricted incident record.

Assign an incident lead, an owner for the privacy decision and a deputy for each. A small organisation may combine roles, but it still needs a reliable route for escalation outside ordinary office hours. Make clear who can approve urgent containment and who coordinates professional advice. A response that depends on one absent director reading an email is vulnerable to avoidable delay.

For the broader governance framework, use the Cyprus GDPR compliance guide.

Basis and guidance: EDPB: data breaches — guide for small businesses

Record awareness and calculate the deadline explicitly

The EDPB explains awareness by reference to a reasonable degree of certainty that an incident has compromised personal data. Record the facts supporting that assessment, rather than choosing the time at which management eventually discussed the matter. Keep the initial alert time and the assessed awareness time distinguishable if they differ, with an explanation that can be reviewed.

As a simple hypothetical calculation, if awareness is established at 15:00 on Friday and no time-zone or daylight-saving change intervenes, 72 hours later is 15:00 on Monday. This is elapsed time, not three working days. It is also not an instruction to wait until Monday: the obligation to act without undue delay remains relevant.

Use an internal decision checkpoint earlier than the outer deadline so that the responsible person can review available facts, prepare a notification if required and resolve submission problems. Record the time zone in the chronology, especially when a supplier sends timestamps from another country. Where a deadline has already been missed, escalate immediately and document the reasons; do not reset the clock to the time the incident reached a more senior person.

Basis and guidance: EDPB: data breaches — guide for small businesses

Keep one chronology with facts, uncertainty and decisions

Begin with a short factual account: which system or process was involved, what was observed, who reported it and what evidence is available. Mark an estimate as an estimate. If the number of affected people changes during the investigation, keep the previous figure and explain why it changed instead of silently overwriting the record.

Capture decisions as well as events. For each significant action, record who decided, what evidence they used and what needs to happen next. This helps a replacement incident lead understand the position quickly and distinguishes an unresolved question from a decision that was actually made. Restrict access because the response file may itself contain sensitive personal and security information.

The table below is a working structure for an incident record. It should be adapted to the organisation and the particular incident. Avoid copying complete affected datasets into every working note: refer to a controlled evidence location and provide only the information needed for the decision being made.

Assess the possible harm to people, not only the business

The notification assessment concerns individuals’ rights and freedoms. A business may be worried about lost sales or reputation, but those concerns do not replace the privacy-risk analysis. Consider what the exposed or unavailable information could enable, who could be affected, and how likely and serious the consequences are in the actual circumstances.

For an operational assessment, ask whether the information could support impersonation, fraud, unwanted disclosure of a private matter, discrimination or loss of access to a needed service. A small number of affected people does not automatically make an incident harmless. Equally, do not describe a speculative worst case as something known to have happened. Separate plausible consequences from confirmed events.

Check the safeguards against evidence. If the response relies on encryption, establish whether the relevant information was protected and whether the keys were compromised. If it relies on access restrictions, examine which permissions actually applied at the time. If it relies on the recipient deleting a message, record the request, response and any limits on what can be verified. A control listed in a policy may not have operated in this incident.

Use the organisation’s data protection impact assessment as relevant background, while assessing the actual incident rather than treating the earlier assessment as conclusive.

Decide on authority notification and use the official route

Notify the competent supervisory authority unless the personal-data breach is unlikely to result in a risk to individuals’ rights and freedoms. This authority-notification test is distinct from the high-risk threshold for communication to affected people. The Cyprus Commissioner’s reporting page provides the notification form and submission instructions; retrieve the current version when an incident occurs instead of relying on an old attachment.

The page currently provides Greek and English forms and describes the English form in the context of cross-border processing. Check the instructions applicable to the submission. The office also provides a contact route for questions about completing the report. If cross-border processing is involved, assess the competent supervisory authority; the location of a server alone should not be treated as the entire jurisdictional analysis.

Before sending, check the organisation’s details, incident reference, contact person and the distinction between established and provisional information. Preserve the submitted version, attachments and evidence of transmission. A draft stored on a laptop does not establish that notification occurred. Assign someone to monitor replies and requests for further information, including during an absence.

Basis and guidance: Cyprus Commissioner: data-breach notification; EDPB: data breaches — guide for small businesses

Submit available information and manage updates where needed

An incomplete investigation does not automatically justify postponing a required notification. The EDPB describes providing information in phases where it cannot all be supplied at once. Identify what is known, what remains under investigation and who will provide the next update. If notification is late, explain the delay rather than omitting the chronology.

Prepare a concise description of the incident and its likely consequences, the affected categories and approximate numbers where available, a contact point, and the measures taken or proposed. Keep a change log for later updates. For example, if further investigation reduces an initial estimate of affected accounts, explain the evidence supporting the revised scope.

Give each open question an owner and a review point. “Awaiting supplier” is not a complete action plan if nobody has asked the supplier what information is needed or when it can respond. Request the specific logs, system boundaries or account details required for the assessment, using an appropriate secure channel. Keep requests proportionate and avoid spreading the compromised information further.

Basis and guidance: EDPB: data breaches — guide for small businesses

Assess communication to affected individuals separately

The European Commission distinguishes authority notification from communication to individuals where a breach is likely to create a high risk. It also describes relevant exceptions involving effective protective measures or measures taken after the event. Do not assume that notifying the authority automatically fulfils the obligation to people, or that a low-risk conclusion can be reused without examining their circumstances.

When communication is required, use clear, practical language. Explain what happened, what information was involved, the likely consequences, what the organisation has done and what the recipient can usefully do. Provide a contact point that is staffed and briefed. Avoid vague reassurance such as “your security is our priority” in place of facts that would help someone protect themselves.

Choose a delivery method that does not create a second disclosure. Check recipient lists and avoid revealing affected people to one another. Where practical protective action is urgent, do not delay the useful warning merely to finish a polished general statement. If later facts materially change the advice, arrange an update and preserve which version was communicated to which group.

Basis and guidance: European Commission: GDPR business obligations

Make supplier escalation work in practice

A processor must inform its controller without undue delay after becoming aware of a personal-data breach. The controller still needs to assess its own obligations. A supplier’s promise to investigate is therefore not a reason for the controller to stop its chronology or wait indefinitely for a complete report.

Ask the supplier for the facts that matter: affected services, relevant dates, personal-data categories, access or disclosure evidence, containment and remaining uncertainty. Establish a named incident contact and a backup. For a shared platform, distinguish facts about the whole platform from evidence about your organisation’s records. A general incident notice may not answer that narrower question.

After the immediate response, compare actual cooperation with the contractual process. Did the message reach the right person? Could the supplier identify relevant subprocessors? Was the information sufficiently specific to support decisions? Record improvements to contacts and procedures without assuming that a contract amendment alone demonstrates operational readiness.

Review those arrangements against the Article 28 processor-agreement checklist.

Basis and guidance: EDPB: data breaches — guide for small businesses

Worked scenario: a payroll file sent to the wrong recipient

Assume an employee sends a payroll spreadsheet to an unintended external recipient. The response begins by identifying the file version and its contents, the recipient, whether a link or attachment was sent, and any access evidence. Stop further sharing and involve the appropriate technical and privacy contacts. Preserve the original message and relevant logs through a controlled process.

A request to delete the file and the recipient’s response can be relevant, but the assessment should state what they establish and what remains uncertain. Payroll records may contain more than salary figures: examine the actual columns rather than relying on the filename. Consider the people affected and the realistic consequences of the particular disclosure.

The scenario has no automatic notification answer without those facts. Record the authority-notification and individual-communication decisions separately, with their reasons and review triggers. Then address the sending process: recipient verification, sharing permissions and the amount of information included. Test the revised procedure using a safe example with fictional data, not a further copy of the payroll file.

For routine handling of employee records, use the employee personal-data guide.

Close the incident with verified actions and rehearse the next response

Containment is not the same as closure. Check that outstanding access has been removed where appropriate, the affected service can operate safely, required updates have been provided and agreed corrective work has an owner. Preserve the evidence and decision record under the organisation’s applicable retention arrangements, with continuing access controls.

Use a short retrospective to identify why the incident happened and where the response slowed down. Focus on specific changes: a replacement contact, a tested restore process, a clearer recipient check or a revised supplier escalation path. Record how completion will be demonstrated. A training session scheduled for next month is a planned action, not evidence that the underlying problem has already been fixed.

Rehearse a realistic scenario with fictional data and test whether someone can locate the official form, calculate a deadline and contact the necessary decision makers. Keep exercise records distinct from real incidents. Where an actual breach requires specialist assessment, Zeno can coordinate appropriate independent professional support; the response should be driven by the incident evidence and the people at risk.

Primary sources and scope

Sources checked: September 27, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Commissioner: data-breach notification
• European Commission: GDPR business obligations
• EDPB: data breaches — guide for small businesses

Practical guides for this topic

• Cyber Resilience Act for Cyprus software vendors: 2026–27 roadmap

  Check whether a Cyprus software product falls under the EU Cyber Resilience Act, act on 2026 reporting duties and prepare security, support and conformity files for 2027.