Unacceptable Risk

For example, AI systems that allow “social scoring” by governments or companies are considered a clear threat to people's fundamental rights and are therefore banned.

High Risk

High-risk AI systems such as AI-based medical software or AI systems used for recruitment must comply with strict requirements, including risk-mitigation systems, high-quality data sets, clear user information, human oversight, etc.

Limited Risk

Systems like chatbots must clearly inform users that they are interacting with a machine, while certain AI-generated content must be labelled as such.

Minimal Risk

Most AI systems such as spam filters and AI-enabled video games face no obligation under the AI Act, but companies can voluntarily adopt additional codes of conduct.

Submit Complaint

Personal Data Protection

PRIVACY POLICY

The Office of the Commissioner of Communications issues this Privacy Policy to inform you about the personal data it processes concerning you, the purpose of such processing, the measures taken to protect your data, and your rights in relation thereto.

Commissioner of Communications guarantees the protection of your personal data and fully complies with the General Data Protection Regulation (GDPR) as well as with all applicable laws, regulations, guidelines, and directives relating to the protection of personal data.

Personal Data We Collect

Commissioner of Communications collects only the data that is strictly necessary for the purpose for which it was provided by the data subjects and uses such data solely for those purposes.
The personal data collected for the purposes described below may include, indicatively, the following: name, title, organization, position within the organization, contact details, and personal data collected through the complaint submission form, among others.

Purpose of Processing and Use of Personal Data

We process your personal data solely for the purpose of complying with our legal obligations and for the performance of our duties in the exercise of the public authority vested in us.

Data Subject Rights

As a data subject, and subject to the limitations provided under the applicable legal framework on data protection, you have the right to be informed and to access your personal data, the right to rectify any data concerning you, as well as the right to object to, restrict, or request the portability of your data.

If you wish to exercise your legal rights or have any questions regarding the processing of your personal data, you may contact us using the contact details provided at the end of this Policy.

If you believe that the protection of your personal data has been violated in any way, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection:
http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/2FBD2ACD407DEFE8C22582B9002E7019

Access to and Disclosure of Your Data to Third Parties

Commissioner of Communications may engage external partners to carry out processing on its behalf (“data processors”), always in accordance with the requirements of the applicable data protection legislation. Such external partners are bound by legal acts or contractual obligations ensuring that your personal data is protected as prescribed by the relevant law.

In all other cases, Commissioner of Communications does not disclose or transfer personal data to any third parties unless required by law in order to fulfil its duties, or as necessary to comply with applicable legal provisions or a court order.

Data Retention Period

Your personal data is retained for the period prescribed by applicable law and for as long as is necessary to carry out the actions required to achieve the purposes of processing.
After the expiration of this period, your personal data will be securely deleted.

Personal Data Security

To protect your personal data, Commissioner of Communications takes all appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of personal data.
The personal data processed by Commissioner of Communications is maintained in both electronic and physical form, stored in a secure environment within the organization, encrypted, and kept in a secure database.
In both cases, access is granted only to authorized personnel of the organization.

Amendments to this Privacy Policy

This Privacy Policy may be amended from time to time. Please check this page periodically for updates regarding our privacy practices.

This notice has been in effect since …./…/2025.

Contact Details

You may contact us freely for any questions regarding the protection of your personal data, to submit a complaint, or to exercise your legal rights:

Data Controller:
Commissioner of Communications
1 Andrea Chaliou Street,
2408 Engomi,
P.O. Box 24412, Nicosia,
CYPRUS
Tel.: +357 22693000
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Data Protection Officer (DPO):
Tel.: +357 22693000
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.