GRC Software in Cyprus: GDPR, NIS2, CySEC and DORA Compliance

Last updated: 19 October 2026

Quick answer: GRC software for Cyprus should let you run GDPR (with Cyprus’s Law 125(I)/2018), NIS2, DORA and CySEC or Central Bank of Cyprus requirements from one set of risks, controls, policies and evidence. Look for a central risk register, cross-framework control mapping, a register of processing activities and DPIA workflows, incident handling that tracks several reporting deadlines, and vendor management that also covers DORA’s ICT third-party rules.

A Cypriot organisation can fall under several regimes at once. A Limassol investment firm may answer to CySEC under DORA, to the Commissioner for Personal Data Protection under GDPR, and to its EU clients’ own vendor due diligence. A ship manager or software company may find itself in NIS2 scope. Each regime has its own regulator, its own incident deadlines and its own reporting expectations.

Many Cypriot compliance teams still run all of this in spreadsheets, shared drives and email. That works until an inspection or a major incident, when the same evidence has to be found, checked and reformatted for different authorities under time pressure.

This guide sets out the Cyprus regulatory landscape, which organisations are affected, what GRC software should do for a Cypriot organisation, and a practical roadmap for getting there. Enactia is headquartered in Cyprus, so this is our home market, but the criteria below apply whichever platform you choose.

Which regulations apply to organisations in Cyprus?

Most Cypriot organisations deal with some mix of GDPR and Law 125(I)/2018, NIS2 as implemented in Cypriot law, DORA for financial entities, and sector rules from CySEC or the Central Bank of Cyprus.

GDPR and Law 125(I)/2018

The GDPR applies directly in Cyprus. Law 125(I)/2018 sits alongside it to use the flexibility the GDPR leaves to Member States. Among other things, it sets 14 as the age at which a child can consent to information society services, sets out how the Commissioner can fine public authorities and bodies, and creates criminal offences for certain serious breaches.

The supervisory authority is the Commissioner for Personal Data Protection. The Commissioner receives breach notifications, handles complaints, carries out investigations and has published guidance, including a list of processing operations that require a data protection impact assessment. Our guide to GDPR in Cyprus and Law 125(I) covers the local provisions in more detail.

After a complaint or breach, expect questions about what data you hold, why, who you share it with and how it is protected. A current, linked ROPA, DPIA set and breach log lets you answer quickly.

NIS2 and the Digital Security Authority

The NIS2 Directive (EU) 2022/2555 extends EU cybersecurity rules to many more sectors than the original NIS Directive. Cyprus already had a network and information security law (Law 89(I)/2020), which set up the Digital Security Authority (DSA) as the national competent authority, with the national CSIRT working under it. NIS2 has been brought into Cypriot law by amending that framework, and the DSA remains the main point of contact for in-scope entities.

For entities in scope, NIS2 means:

• registering with the competent authority and keeping the details current;
• implementing the ten risk-management measures in Article 21, including risk analysis, incident handling, business continuity, supply chain security, cryptography and access control;
• having the management body approve the measures, oversee them and complete cybersecurity training (Article 20);
• reporting significant incidents in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

The directive sets maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. See our overview of cybersecurity in Cyprus and NIS2 for the local picture, and the NIS2 incident reporting guide for the reporting cascade.

DORA for Cypriot financial entities

The Digital Operational Resilience Act (DORA) has applied since 17 January 2025. As a regulation, it applies directly, without national transposition. In Cyprus, supervision follows the existing split: CySEC for investment firms, fund managers and crypto-asset service providers; the Central Bank of Cyprus for credit institutions, payment institutions and e-money institutions; and the insurance supervisor for insurers. Significant banks are also supervised directly by the ECB under the Single Supervisory Mechanism.

DORA’s five pillars are ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, ICT third-party risk management and information sharing. Two pieces of work take the most effort for most Cypriot firms. The first is the register of information covering every contractual arrangement with ICT third-party service providers. The second is the incident classification and reporting process for major ICT-related incidents. Our guide to the DORA register of information explains what the register must contain.

DORA and NIS2 overlap, and DORA takes precedence for financial entities on the matters it covers. If you are unsure which applies to a given group company, see NIS2 vs DORA.

CySEC and the Central Bank of Cyprus

CySEC supervises a large population of Cyprus Investment Firms (CIFs), many of them in online trading, as well as fund managers, administrative service providers and crypto-asset service providers. Beyond DORA, CySEC expects documented governance, independent compliance and risk management functions, robust anti-money laundering procedures and timely regulatory reporting. Our article on CySEC compliance for CIFs looks at reporting and DORA strategy in more depth.

The Central Bank of Cyprus supervises less significant credit institutions, payment institutions and e-money institutions. Its expectations on governance, outsourcing and ICT and security risk now largely run through DORA for in-scope entities.

Other rules worth tracking

• EU AI Act: Regulation (EU) 2024/1689 adds obligations for providers and deployers of AI systems, with the heaviest duties for high-risk systems. See EU AI Act compliance in Cyprus.
• Whistleblowing: Cyprus has transposed the EU Whistleblowing Directive, so organisations above the size threshold need secure internal reporting channels and follow-up procedures.
• Anti-money laundering: obliged entities, including CIFs, banks, accountants, lawyers and administrative service providers, must meet the Cypriot AML law and their supervisor’s directives.

Which Cypriot organisations are most affected?

Financial services feel the heaviest load, but shipping, gaming, technology and professional services firms in Cyprus also carry significant GRC obligations.

Financial services

Banks, CIFs, payment and e-money institutions, fund managers, insurers and crypto-asset service providers face DORA, GDPR, AML and their sectoral supervisor’s rules at the same time. They need an ICT risk framework that the management body approves and reviews, a maintained register of ICT third-party arrangements, and incident processes that can tell a major ICT incident under DORA apart from a personal data breach under GDPR. Often an incident is both.

Shipping and maritime

Limassol is one of Europe’s main ship management centres. Water transport and port operators are listed as a sector in NIS2 Annex I, so larger shipping companies may be in scope. Separately, IMO Resolution MSC.428(98) has required cyber risks to be addressed in ships’ safety management systems since 2021. Ship managers also hold crew personal data, including passports, medical records and payroll data, which brings GDPR into play.

Gaming and betting

Cyprus hosts many video game studios and gaming technology companies, and betting operators licensed locally. They process large volumes of player data, sometimes including data from children, which makes the age-14 consent rule and DPIAs relevant. Licensed betting and gaming operators also have AML duties. Gaming suppliers serving lotteries may be asked to show alignment with the World Lottery Association Security Control Standard.

Technology and digital services

Cyprus has a growing technology sector. Managed service providers, managed security service providers, cloud and data centre providers, and online platforms are named in NIS2, and some fall in scope regardless of size. B2B software companies are increasingly asked by EU banks and insurers to answer DORA-driven due diligence questionnaires, and to show ISO 27001 or SOC 2 alignment.

Professional services

Accountancy firms, law firms, corporate service providers and fiduciaries handle sensitive client and beneficial ownership data and are AML obliged entities. Many also act as outsourced compliance providers, DPOs or administrators for regulated clients, which means they need to manage several organisations’ compliance programmes at once.

What should GRC software do for a Cypriot organisation?

It should hold one model of your organisation, covering assets, processes, vendors, risks and controls, and let you report against GDPR, NIS2, DORA and sector rules from that single model.

1. Cross-framework control mapping. One control, such as access reviews or backup testing, often satisfies GDPR Article 32, NIS2 Article 21, DORA and ISO 27001 at once. The tool should let you implement it once and show it against each requirement.
2. A central risk register. Risks from DPIAs, vendor assessments, ICT assessments and audits should feed one register, with owners, a scoring method you can customise to your risk appetite, treatment plans and history.
3. Privacy operations. A ROPA, DPIA workflows, data mapping and data subject request handling with deadline tracking are essential for any organisation answering to the Commissioner. Our GDPR ROPA guide explains what the records must include.
4. Incident and breach management with multiple clocks. A single incident might trigger the GDPR 72-hour notice, the NIS2 24-hour early warning or DORA major incident reporting. The tool should record the facts once and track each reporting obligation separately.
5. Vendor and ICT third-party management. Keep a vendor inventory linked to the assets and processes each vendor supports, run due diligence questionnaires, track data transfers and contracts, and produce what you need for the DORA register of information.
6. Policy management. Draft, approve, distribute and review policies, track staff acceptance, and link policy sections to the controls they implement.
7. Evidence and audit trail. Store evidence against controls with dates and owners, so an inspection or certification audit becomes a matter of export rather than searching.
8. Board-level reporting. NIS2 and DORA both put responsibility on the management body. Dashboards should show risk posture, open findings and compliance levels in a form the board can review and approve.
9. Multi-entity support. Groups with several Cypriot and EU entities, and service providers acting for many clients, need separate workspaces with consolidated reporting.

Questions to ask vendors

• Which of the frameworks you need are available as ready-made content, and how is the content kept up to date when guidance changes?
• Where is data hosted, and how is it protected? Many Cypriot regulated firms will want EU hosting and a clear sub-processor list.
• Can the tool handle GDPR and cybersecurity in the same place, or will your DPO and CISO end up in separate systems?
• How long does a typical implementation take for an organisation of your size, and who does the configuration?
• Is local support available in your time zone, and does the vendor understand Cypriot supervisors’ expectations?

Enterprise suites such as OneTrust or Archer tend to suit large organisations with dedicated admin teams. Lighter compliance automation tools are often built around SOC 2 and ISO 27001 for software companies and may cover EU privacy or DORA less deeply. Mid-sized Cypriot firms often need something in between.

How to build a GRC programme in Cyprus: a practical roadmap

Start by confirming which regimes apply to each legal entity, build an inventory and risk register, map controls once across frameworks, then put incident, vendor and reporting processes on top.

1. Confirm scope for each legal entity. List every entity in the group and record which apply: GDPR, NIS2 (essential, important or out of scope), DORA, CySEC or Central Bank rules, AML, the AI Act. Document the reasoning, especially for borderline NIS2 cases.
2. Register where required. Complete NIS2 registration with the DSA where applicable, confirm DPO details have been communicated to the Commissioner if you have appointed one, and check sector authorisation conditions are still met.
3. Build your inventory. Record assets, business processes, data types and vendors, and link them together. This feeds your ROPA, your DORA register of information and your NIS2 risk analysis.
4. Assess and register risks. Run risk assessments at asset and process level, carry out DPIAs where the Commissioner’s list or GDPR Article 35 requires them, and bring all risks into one register with owners.
5. Map controls across frameworks. Choose a base control set, such as ISO 27001 Annex A, and map GDPR, NIS2 Article 21 and DORA requirements to it. Identify gaps and assign remediation tasks with deadlines.
6. Write and approve policies. Put policies through management approval, distribute them, record staff acceptance and set review dates. Under NIS2 and DORA, the management body’s approval should be documented.
7. Set up incident and breach handling. Define classification criteria for GDPR breaches, NIS2 significant incidents and DORA major ICT incidents, and assign who reports to the Commissioner, the DSA or your financial supervisor.
8. Manage third parties. Tier vendors by criticality, run due diligence and review contracts for the clauses DORA and GDPR Article 28 require. Keep the register of information current.
9. Test, audit and report. Run internal audits and resilience testing, track findings to closure and give the board regular reports on risk and compliance status.
10. Review on a cycle. Revisit scope, risks and policies at least yearly, and whenever the business changes through new products, acquisitions, new countries or new critical vendors.

In practice: steps 3 and 5 save the most time later. An inventory that links assets, processes and vendors, combined with controls mapped once across frameworks, means a new requirement becomes a mapping exercise rather than a new project.

How does Enactia support Cypriot organisations?

Enactia is a GRC platform for cybersecurity and data protection, headquartered in Cyprus. It covers the regimes most Cypriot organisations face in one platform, available as a complete platform or as individual modules.

• Frameworks: GDPR, NIS2, DORA, ISO 27001, ISO 27701, NIST CSF, the EBA ICT and Security Risk Management Guidelines, PSD2, PCI DSS, SOC 2, ISO 42001 and WLA-SCS:2020, among others. See the full list of supported frameworks and regulations.
• Privacy: ROPA, DPIA, data mapping and data subject request modules for DPOs.
• Risk and controls: an enterprise risk register that pulls in risks from privacy, cybersecurity and vendor assessments, with customisable scoring and an extensive control catalogue.
• Operations: incident and data breach management, policy management, asset management, whistleblowing management, evidence management and task tracking.
• Third parties: vendor and third-party management with assessment templates, data transfer tracking and transfer impact assessments.
• Service providers: a multi-tenant edition for MSPs and consultancies delivering virtual DPO and CISO services.

Frequently asked questions

Who enforces GDPR in Cyprus?
The Commissioner for Personal Data Protection. The Commissioner receives breach notifications and complaints, carries out investigations and can impose administrative fines under the GDPR and Law 125(I)/2018. Personal data breaches must generally be notified to the Commissioner within 72 hours of becoming aware of them, unless the breach is unlikely to result in a risk to individuals.

Who is the NIS2 authority in Cyprus?
The Digital Security Authority is the national competent authority for network and information security, and the national CSIRT operates under it. Entities in NIS2 scope register with, and report significant incidents to, the authorities designated under Cypriot law. Check the DSA’s current guidance for registration steps and forms.

Does DORA apply to Cyprus Investment Firms?
Yes. Investment firms are financial entities under DORA, which has applied since 17 January 2025. CIFs must have an ICT risk management framework, report major ICT-related incidents, test their resilience, manage ICT third-party risk and keep a register of information. CySEC is the competent authority for CIFs.

If we comply with DORA, do we also need to comply with NIS2?
For financial entities, DORA takes precedence over NIS2 on ICT risk management, incident reporting and testing. Other companies in the same group that are not financial entities, such as a technology subsidiary, may still fall under NIS2. GDPR applies alongside both.

Can one GRC platform cover GDPR, NIS2 and DORA together?
Yes, if it maps a shared control set to each framework and keeps separate reporting workflows where the regimes differ, for example different incident deadlines and recipients. This avoids running the same assessment three times and keeps evidence consistent across regulators.

Is ISO 27001 mandatory in Cyprus?
No. ISO 27001 certification is not a legal requirement in Cyprus, but it is a widely used way to structure an information security programme. Its controls map well to NIS2 Article 21 and DORA, and EU clients often ask for it in due diligence.

Bringing Cyprus compliance into one place

Cypriot organisations rarely face just one regulation. GDPR and Law 125(I)/2018, NIS2, DORA and sector rules from CySEC or the Central Bank of Cyprus overlap in their requirements but differ in their regulators, deadlines and reporting formats. A GRC platform that keeps one inventory, one risk register and one control set, and reports to each regime from it, is the most practical way to keep on top of them.

To talk through your Cyprus compliance programme, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.