Can I request my personal data from a company in Cyprus?
Yes — you have the right to access your personal data. Under GDPR (Article 15) and national Law 125(I)/2018, you can ask any controller for the data they hold about you. Supervisory authority: the Commissioner for Personal Data Protection. The reply is given without undue delay and within 1 month of receipt, extendable by 2 further months for complex/numerous requests (you must be told within the first month). The first copy is free. In short: yes, by an access request, free and within a month.
📋 The rules
- Right of access: GDPR art. 15 + Law 125(I)/2018
- Supervision: Commissioner for Personal Data Protection
- Reply within 1 month (+2 for complex)
- First copy free
- Refusal only if request manifestly unfounded/excessive
🔓 Exceptions
- Reasonable fee or refusal only if manifestly unfounded/excessive (e.g. repetitive)
- Reasonable fee for additional copies
- The controller bears the burden of proof
⚠️ Penalties & fines
If the controller doesn't reply within the deadlines or refuses without justification, you can lodge a complaint with the Commissioner for Personal Data Protection, who can impose corrective measures and GDPR fines. Beware a myth: "the company can charge me or refuse whenever it likes" is false — the first copy is free, and refusal/charging is allowed only where the request is manifestly unfounded or excessive, with the burden on the controller. Tip: send a written access request and keep proof of the date.
📎 Official sources
❓ Frequently asked
Can I request my data?
Yes. Under Article 15 of the GDPR and national Law 125(I)/2018, you have the right to ask any company or organisation for access to the personal data it holds about you, along with information about the purpose and recipients of the processing.
How long does the company have to reply?
The controller must reply without undue delay and within one month of receiving the request. The deadline can be extended by a further two months for complex or numerous requests, provided you're informed within the first month of the extension and the reasons.
Do I have to pay?
Not for the first copy, which is provided free of charge. A reasonable fee may be charged only for additional copies, or where the request is manifestly unfounded or excessive, for example repetitive. In that case, the controller must prove that this is so.
What if the company refuses?
If the controller doesn't reply within the deadlines or refuses without justification, you can lodge a complaint with the Commissioner for Personal Data Protection. The Commissioner can impose corrective measures and fines under the GDPR for breaches of your rights.
How do I make the request?
Send a written access request to the controller, that is the company or organisation. Keep proof of the date you sent it, so you can track the reply deadline. You don't need to justify why you're requesting access to your own personal data.
🔎 Common searches
What people search to land here:
- “personal data access cyprus”
- “gdpr data request cyprus”
- “data protection commissioner cyprus”
- “right of access article 15”
- “my data company cyprus”
- “gdpr subject access cyprus”