Cyprus named its Digital Services Coordinator, made a register of intermediary service providers compulsory, and set a daily fine of up to 5 per cent of worldwide turnover.
Cyprus implemented the Digital Services Act on 11 July 2025, and almost nobody providing an intermediary service into the Republic has noticed. The Law providing for the implementation of Regulation (EU) 2022/2065, Law 122(I)/2025, was published in Official Gazette No. 5047 on that day and carries no separate commencement provision, so it took effect on publication.
It does four things that matter to a business: it names the regulator, it draws the jurisdictional net wider than most people expect, it creates a compulsory register, and it sets a penalty that is not the number in the headline.
The regulator, and how independent it is
Section 4(1) designates the Authority as Digital Services Coordinator under Article 49(2) of the Regulation. The Authority is the Radio Television and Digital Services Authority, established under section 3 of the Radio and Television Organisations Law, and it exercises all the powers and competences the Regulation and this Law confer on a Coordinator, together with those under Regulations and circulars issued under the Law.
Section 4(2) is written in unusually strong terms. In carrying out its duties and exercising its powers the Coordinator acts with impartiality, transparency and complete independence, remains free of any external, direct or indirect influence, and neither seeks nor takes instructions from any public sector authority or any private body.
Section 5(1) borrows the institutional machinery: in exercising the Authority's competences as Coordinator, the provisions of paragraphs (a) to (d) of section 3(3), section 3(4), section 3B, sections 4 to 8A, section 9 and sections 40 and 41 of the Radio and Television Organisations Law apply.
Whether the Law reaches you
Section 3 is four paragraphs, and the fourth is the one that catches people. The Law applies to providers of intermediary services who:
- are established in the Republic;
- have legal representatives residing or established in the Republic;
- have a substantial connection with the Republic; or
- provide intermediary services in the Republic without having a substantial connection with it.
A platform with no office here, no representative here and no substantial connection is still within paragraph (d) if it supplies into Cyprus. That is the whole of the test, and it is worth reading before concluding that a foreign-domiciled service is outside the Cyprus regime.
The register, and the deadline nobody is watching
Section 13(1) required the Coordinator, within twelve months of the Law's entry into force, to create, operate and maintain a Register of Providers of Intermediary Services in electronic form and to publish it on its official website. The Law took effect on 11 July 2025, so that period ran to 11 July 2026.
Section 13(2) is the obligation on the provider. Providers falling within the scope of the Law are compulsorily registered, within three months of the Register becoming operational, or before beginning to provide intermediary services in the Republic, whichever applies.
Section 13(3)(a) sets the minimum content for each provider: the registration number and date of registration; the name of the natural person or the corporate name of the legal person; the residential address of the natural person, or the seat and registered office address of the legal person; and the contact details of a point of contact in the Republic for communications with the Coordinator, the competent authorities in the Republic, the competent authorities of other Member States, the European Commission and the European Board for Digital Services.
For most providers the practical work is that last item. A point of contact is a person and an address, and appointing one is a decision, not a formality.
Orders against content, and orders for information
Section 12(1) requires the competent authorities to ensure that the orders to act against illegal content which they issue satisfy the conditions in Article 9 of the Regulation, and section 12(2) requires the Coordinator to follow the procedure and time limits Article 9 sets for such orders.
Section 12(3) applies the same discipline to orders to provide specific information about one or more identified individual recipients of the service, against the conditions in Article 10 of the Regulation.
If an order arrives, whether it meets those conditions is the first question, and it is a question with a defined answer rather than a matter of impression.
What a breach costs
Two regimes run alongside each other.
Section 19(1) requires the Coordinator or the competent authority, according to competence under section 6, to impose an administrative fine on providers within their jurisdiction, applying Article 51(2)(c) and (d) of the Regulation. Section 19(2) applies Articles 51 and 52 and lists what is weighed: the nature, gravity and duration of the infringement; any intent or negligence of the provider that caused it; systematic or repeated non-compliance; the type, size and nature of the intermediary service and the provider's economic capacity; whether the provider operates in more than one Member State; and the degree of cooperation with the authority.
Section 20(1) adds a criminal offence. A person who does an act or makes an omission in breach of any provision of Regulation (EU) 2022/2065 is guilty of an offence carrying imprisonment of up to one year or a fine of up to EUR 10,000, or both, without prejudice to the Law on the Application of Community Regulations and Decisions.
Section 20(2) is the provision that changes the size of the risk. Where a fine is imposed under section 20(1), it shall not exceed five per cent of the average daily worldwide turnover or income of the provider concerned in the preceding financial year, per day, calculated from the date fixed in the relevant decision. Read with the EUR 10,000 figure above it, the ceiling is a daily one measured against global turnover, not a single capped sum.
Section 20(3) gives the court trying such an offence power to make any interim or final order, prohibitory, preventive, mandatory or suspensory, to terminate or suspend the act or omission constituting the offence or to prevent its repetition.
Challenging a decision
Section 14(1) provides that decisions of the Coordinator are directly enforceable and that their application does not require the approval of any state or other body. There is no administrative appeal step to buy time.
Section 14(2) gives a recourse against decisions of the Coordinator or of the competent authorities to the Administrative Court under Article 146 of the Constitution. The deadline runs from the decision reaching you, which is why the date on the covering letter matters as much as its contents.
The fee
Section 17(1)(a) allows the Coordinator to impose an annual fee on persons within the scope of the Law, and section 17(1)(b) confines it to what is necessary and proportionate to cover the cost of the Coordinator's tasks.
Section 17(2) allows the Coordinator not to impose it where a person's total worldwide or national annual turnover from activities within the scope does not exceed a threshold, or their activities do not reach a minimum market share, or are of very limited geographical reach, or they provide particular categories of intermediary service. The thresholds themselves are not in the Law.
Section 16(1) explains the design: the revenue for the Coordinator's operation comes from the administrative fines and the fees imposed under the Law. Section 16(2) requires the Republic to ensure the Coordinator and the competent authorities have the resources to supervise the providers within their competence, as Article 50 of the Regulation requires.
What to do
If you host user content, run a marketplace or an app store, operate an online platform or search engine, or provide caching or mere conduit services into Cyprus, the questions are in order: whether section 3 reaches you, whether the Register is operational and your three months have started, who your point of contact in the Republic is, and whether your notice and action mechanism answers Articles 9 and 10 when an order arrives.
If an order or a decision has already arrived, the first thing to establish is the date it reached you, because section 14(2) runs from then.
What to send us
The service you provide and the countries you provide it into. Whether you have an establishment, a legal representative or a point of contact in Cyprus. Any order or correspondence from the Authority, with the date it reached you. And your existing terms and notice and action procedure, if you have one.
Questions we are asked
Who is the Digital Services Coordinator in Cyprus?
Section 4(1) of Law 122(I)/2025 designates the Radio Television and Digital Services Authority, established under section 3 of the Radio and Television Organisations Law, as the Digital Services Coordinator under Article 49(2) of Regulation (EU) 2022/2065. It exercises all the powers the Regulation and this Law give the Coordinator. Section 4(2) requires it to act with impartiality, transparency and complete independence, free from any external direct or indirect influence, and neither to seek nor to take instructions from any public sector authority or any private body.
Does the Law apply to my business?
Section 3 casts the net in four ways, and the fourth is the one people miss. The Law applies to providers of intermediary services established in the Republic; to providers whose legal representatives reside or are established in the Republic; to providers having a substantial connection with the Republic; and to providers who supply intermediary services in the Republic without having a substantial connection with it. A platform with no office and no representative here is still caught by paragraph (d) if it supplies into Cyprus.
Is there a register, and must I be on it?
Yes to both. Section 13(1) required the Coordinator, within twelve months of the Law coming into force, to create, operate and maintain an electronic Register of Providers of Intermediary Services and publish it on its official website. The Law was published in Official Gazette No. 5047 on 11 July 2025 and carries no separate commencement provision, so that twelve months ran to 11 July 2026. Section 13(2) then makes registration compulsory for providers within the scope of the Law, within three months of the Register becoming operational or before beginning to provide intermediary services in the Republic.
What has to go on the register?
Section 13(3)(a) sets a minimum for each provider: the registration number and date of registration; the name of the natural person or the corporate name of the legal person; the residential address of the natural person or the seat and registered office address of the legal person; and the contact details of a point of contact in the Republic for communications with the Coordinator, the competent authorities in the Republic, the competent authorities of other Member States, the European Commission and the European Board for Digital Services.
What does a takedown order have to satisfy?
Section 12(1) requires the competent authorities to ensure that orders to act against illegal content which they issue meet the conditions in Article 9 of Regulation (EU) 2022/2065, and section 12(2) requires the Coordinator to follow the procedure and time limits Article 9 lays down. Section 12(3) does the same for orders to provide specific information about one or more identified individual recipients of the service, against the conditions in Article 10 of the Regulation. An order that does not meet those conditions is the first thing to test.
How are administrative fines set?
Section 19(1) requires the Coordinator or the competent authority, according to their respective competence, to impose an administrative fine on providers under their jurisdiction applying Article 51(2)(c) and (d) of the Regulation. Section 19(2) applies Articles 51 and 52 of the Regulation and lists what is weighed: the nature, gravity and duration of the infringement; any intent or negligence of the provider that caused it; systematic or repeated non-compliance; the type, size and nature of the service and the provider's economic capacity; whether the provider operates in more than one Member State; and the degree of cooperation with the authority.
Is a breach also a criminal offence?
Yes. Section 20(1) makes it an offence, without prejudice to the Law on the Application of Community Regulations and Decisions, for a person to do an act or make an omission in breach of any provision of Regulation (EU) 2022/2065. It carries imprisonment of up to one year or a fine of up to EUR 10,000, or both.
What is the daily fine ceiling?
Section 20(2) is the provision to read before assuming the EUR 10,000 figure is the exposure. Where a fine is imposed under section 20(1), it shall not exceed five per cent of the average daily worldwide turnover or income of the provider concerned in the preceding financial year, per day, calculated from the date fixed in the relevant decision. For a large provider that is a materially different number from the headline.
Can a court order more than a fine?
Section 20(3) gives the court trying an offence under the Law power to make any interim or final order, prohibitory, preventive, mandatory or suspensory, for the purpose of terminating or suspending the act or omission constituting the offence, or preventing its repetition.
Are the Coordinator's decisions immediately effective?
Section 14(1) provides that decisions of the Coordinator are directly enforceable and that their application does not require the approval of any state or other body. Section 14(2) gives a recourse against decisions of the Coordinator or of the competent authorities to the Administrative Court under Article 146 of the Constitution. The deadline for that recourse runs from the decision reaching you, so the date it arrived matters as much as its contents.
Will I have to pay an annual fee?
Section 17(1)(a) allows the Coordinator to impose an annual fee on persons within the scope of the Law, and section 17(1)(b) confines it to what is necessary and proportionate to cover the cost of the Coordinator's tasks. Section 17(2) allows the Coordinator not to impose it on persons whose total worldwide or national annual turnover from activities within the scope does not exceed a threshold, or whose activities do not reach a minimum market share, or are of very limited geographical reach, or who provide particular categories of intermediary service.
Where does the Coordinator's money come from?
Section 16(1) provides that the revenue for the Coordinator's operation comes from the administrative fines and the fees imposed under the Law. Section 16(2) requires the Republic to ensure that the Coordinator and the other competent authorities have the financial resources to carry out their duties, including sufficient technical, financial and human resources to supervise the providers within their competence, as Article 50 of the Regulation requires.
Sources
- Law providing for the implementation of Regulation (EU) 2022/2065 on a Single Market for Digital Services, 122(I)/2025, Official Gazette No. 5047, 11 July 2025
- Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services (Digital Services Act)
This article is provided for general information purposes only and does not constitute legal advice.
Klitos Platis
Advocate, Partner
Kleanthous & Platis LLC, Nicosia · Published 24 August 2026
Need advice on your own matter?
Send us the documents and a short description at office@kleanthousplatis.com and we will reply within one business day.
Or use the enquiry form, message us on WhatsApp, or call +357 22 680 330.
When Cyprus law changes, hear it from us
One short email when something changes that matters: new legislation, a decision worth knowing, a deadline. Written by the partners, no marketing, unsubscribe with one click.
Your address is used for these updates and nothing else.
More on this: What a Cyprus trader must now tell a consumer, AI Tools and Client Confidentiality: What a Professional Firm Must Settle First, Smart Contracts and Cyprus Property Transactions: Where They Stand, The EU Artificial Intelligence Act: What a Business Has to Do About It, When an AI System Causes Loss: Liability, Data Protection and Contracts.