The evolution of the national economy, the accession process to the European Union with harmonisation efforts and the geostrategic position of Cyprus as a hub between the East Mediterranean region and the Middle East, have resulted in high growth in the ICT market. National strategy in the IT field has been focused on the creation of a modern infrastructure in order to promote Cyprus as a regional pole and the encouragement of competition in the Cypriot IT market.

Realising the significance of the revolution on information and communication technologies, and the importance of e-Commerce in the new globalized world, the Government of the Republic of Cyprus has commissioned the preparation of a study for a National Strategic Plan. The objectives of this study were the formulation of the legal framework and a national policy for an e-Commerce strategy to place Cyprus at the forefront of the most competitive and dynamic knowledge-based economies.

One of the results of this investigation was the enactment of legislation on e-commerce and electronic signatures matters on April 29, 2004 in view of Cyprus’ accession to the EU.

Another development in the field of e-commerce regulation was the introduction by the Ministry of Commerce, Industry and Tourism in June 1999 of its New Industrial Policy. One of its objectives was the creation of new high technology industrial units through the setting up and operation of business incubators, and the enhancement of the applied research capability of the country. The technology-incubating program seeks to effectively link talent, technology, capital and know-how to leverage entrepreneurial talent in order to accelerate the development of new, high-potential enterprises in high growth sectors, including the fields of information technology and telecommunications.

For this purpose, it aims at facilitating methods and techniques by which private enterprises re-engineer their business to implement business-to-business e-Commerce solutions. To attract and enhance inflows of foreign e-Commerce business in Cyprus, the Government tries to promote the island as an e-Commerce hub, through the creation of promotional sites on the Internet and other publicity and advertising campaigns. In this context, it aims at building up consumers' trust and confidence by offering advice on safe internet shopping, raise the awareness and educate consumers on business to consumers operations. One area in which action has been taken is the protection of citizens' rights with regard to privacy, confidentiality and anonymity, through the enactment of the Processing of Personal Data (Protection of the Person) Law of 2001 to 2003.

Impact of Cyprus’ Membership to the European Union in the Field of E-Commerce

The membership of Cyprus to the EU, will increase its cooperation with the other member states and will be able to decrease the gap in respect of the e-Commerce field and the Information and Communication Technology market in general. This will result in positioning Cyprus’ economy closer to those of the most advanced European countries. Cyprus will, for example, be able to achieve at a maximum, the goals set out in the e Europe+ (e-Europe plus) Action Plan in which Cyprus participates.


Main Legislation

Electronic Commerce

The main legislation in Cyprus in the field of e-commerce is the Law on Certain Legal Aspects of Information Society Services, in Particular Electronic Commerce and Associated Matters of 2004, Law 156(I)/2004 (The Electronic Commerce Law). The Law has been enacted on 30 April 2004 for the purpose of implementing Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce).

The Electronic Commerce Law aims at ensuring the free movement of information society services between the Republic and the Member States of the European Union, relating to the establishment of service providers, commercial communications, the conclusion of electronic contracts, the liability of intermediaries, codes of conduct, out-of-court dispute settlements, means of legal protection and the cooperation between Member States.

The Law applies to all information society services normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services, within the meaning of section 2 of the Law for the Procedure for the Provision of Information on Certain Technical Rules of 2003 to 2004.A service provided at a distance is defined as a service provided without the parties being simultaneously present, but does not include services provided in the physical presence of the provider and the recipient, even if they involve the use of electronic devices.

A service provided by electronic means is defined as a service provided at its starting point and received at its destination by means of electronic processing equipment, including digital compression or storage of data, and which is entirely transmitted, conveyed and received by a telephone line, by radio, by optical fibre or by other electromagnetic means.

Services supplied at the individual request of a recipient of services are defined as services provided by transmitting data following an individual demand but does not include services provided by the simultaneous transmission of data without individual demand and which are destined for the simultaneous reception by an unlimited number of individual receivers (point to multipoint transmission).


Value Added Tax


According to the Value Added Tax Law as amended in 2004, where services are provided by a person who is a citizen of a country other than the Republic and are received by a person who is a citizen of the Republic for the purpose of the receiver to carry out his business, then the person providing the said service is subject to VAT as if the receiver had himself provided the service within the Republic within the framework of his business activities or for the promotion of his business activities. The provision of services in this manner is, therefore, deemed to be taxable and the service is deemed to be provided at the place where the service is received.

The following services are deemed to be provided at the place where the service is received and are, as a result, taxable:

Provided that, where the supplier of a service and his customer communicate via electronic mail, this does not of itself mean that the service performed is an electronic service.


Electronic Signatures


The principal legislation in Cyprus governing electronic signatures is the Legal Framework for Electronic Signatures and Associated Matters Law of 2004 (Law 188(I)/2004)

It effectively establishes the legal framework governing electronic signatures and certain certification-services for the purpose of facilitating the use of electronic signatures and their legal recognition. It does not, however, cover aspects related to the conclusion and validity of contracts or other legal obligations which are governed by requirements as regards their form. Furthermore, it does not affect rules and limitations in relation to the use of documents provided by other applicable legislation in force.

The Law affords power to the Minister of Commerce, Industry and Tourism (the Competent Authority) to exercise control over and ensure the effective application of this Law, and, in particular, to:

Electronic Money Institutions

The Electronic Money Institutions Law of 2004 (Law 86(I)/2004) entered into force on 16 April 2004 for the purpose of adopting Directive 2000/46/EC of the European Parliament and of the Council on the taking up, pursuit of and prudential supervision of the business of electronic money institutions and Directive 2000/28/EC of the European Parliament and of the Council amending Directive 2000/12/EC relating to the taking up and pursuit of the business of credit


Processing of Personal Data (Protection of the Person) Law of 2001 to 2004

The Law, applies to automated processing of personal data, which is included or will be included in a record. Processing of personal data means every work or series of works which is accomplished by any person with or without the help of automated methods and which is applied to personal data. It includes the collection, filing, organisation, preservation, storage, alteration, export, usage, transfer, dissemination or any other form of disposal, alignment or combination, interconnection, blocking, erasing or destruction.

The Law also protects persons from the electronic transfer of their processed data or of data which will be processed when they are transferred to another country. This is allowed only when the Commissioner has granted a permit. The Commissioner will only grant the permit if he thinks that the aforesaid country ensures a sufficient level of protection. To this effect, he mainly takes into consideration the nature of the data, the purposes and term of processing, the relevant general or specific legal rules, the ethics codes, the security measures for data protection, as well as the level of protection of the countries of origin, passage and final destination of the data.

With regard to unsolicited commercial communications, otherwise spam, section 15 of the Data Protection Law provides that personal data cannot be processed by anyone for purposes of direct marketing or provision of services at a distance, unless the data subject notifies his written consent to the person responsible for processing (data controller). If a controller wishes to carry out processing of personal data for the above purposes, he may, for the purpose of obtaining the data subject’s consent, use his name and address, on condition that the data has been obtained from sources accessible to public.

As a result, companies conducting marketing campaigns may not send any form of marketing information in electronic (or non-automated) form such as e-mail, sms, mms, etc, if the person receiving the said information has not explicitly consented prior to this. Furthermore, marketing companies acting on behalf of customer companies who wish to inform their clients or other persons of their products, must ensure that the said customer companies have acquired personal data such as mobile or fixed telephone numbers, e-mails and addresses in a manner that does not violate the obligations set out by the Law.

This means that the company on behalf of which a marketing campaign will be conducted, must have proof that personal data has been acquired with the consent of the clients of the company contracting the marketing company, either by signing a specific document or by giving their consent through registering in a website which contains specific data protection provisions. Furthermore, an agreement must also be signed between the customer company (data controller) and the marketing company providing a marketing campaign service on behalf of the data controller (data processor). In other words, an agreement must be in place between the data controller and the data processor.

Law concerning the Rights and Obligations of parties to Consumer Contracts concluded at a distance (N. 14 (I)/2000)

The Law does not exclude de facto contracts made over electronic means. According to Article 2 of the Law, a means of communication that can be used for the conclusion of an agreement between seller and consumer can be electronic mail. Therefore, this Law could be applied for electronic commerce purposes.

Domain Names

In Cyprus, domain names can be applied for under the CY TLD located at the University of Cyprus in Nicosia. The University of Cyprus has recently adopted new rules, prepared by our Office, which have made some fundamental changes to the grants of licences for domain names in Cyprus. The following is an outline of the main provisions:

Persons can apply for a domain name directly to the NIC-CY or via an Internet Service Provider. Any company can apply for a domain and get a licence to use a Domain Name for the whole of its name as this has been registered at the Registrar of Companies and Official Receiver, or a combination of letters, provided that the line of chosen letters remains the same as it appears on the name of the registered company or trade name, the chosen name does not have a generic meaning, and the chosen name does not violate any regulations or coincides with any other registered name of a company or trade name. Any natural person can apply for a domain but he must have completed the 18th year of age at the time of the application. A copy of the identification card is required.

The applicant does not need a residence/domicile in Cyprus. However, the administrative contact listed in the registration from must provide proof that he is a Cypriot OR a permanent resident of Cyprus. Concerning foreign companies, they may obtain a licence to use only if they have a trademark.

10 Domain name allocations are allowed per a single registrant. The University may consider special relief to allow the allocation of additional Domain Names upon demonstration of a need for additional names. One domain name is allowed per individual. Exceptions can be made in cases where the individual is also a member of an organization in which case he/she can register an extra domain name on behalf of this organisation.

The registration of the Domain name does not in any way imply reservation of a name or trade mark or ownership of the domain name but merely a licence to use the domain name for the licence period. Ownership and all rights of the Domain name under the .cy top level domain remains with NIC CY. The licence to use the domain name is issued to the organisation or individual (registrant), which appears on the registration form. According to this, the licence to use the domain name is issued to the registrant and not to the ISP that offers the name server support.

Domain names may be transferred. The original registrant is required to confirm the release of the existing domain name which he holds by letter or fax onto the organisation’s letterhead. Upon release of a domain name by its registrant, a new application and registration fee must be submitted by the new registrant of the domain name.

Domain Allocation & Intellectual Property Rights

Regarding Intellectual Property rights in Cyprus, trademarks, company names, business names, as well as Unfair competition claims including passing off and well know names can be used to attack a domain name licensee. When applying for a domain name an applicant undertakes that the laws of Cyprus including international treaties ratified by the Republic of Cyprus from time to time relating to Intellectual Property issues (e.g. trademark, copyright and famous names issues), as well as the ICANN Dispute Policy, are not violated. Dispute Policy means the ICANN Uniform Dispute Resolution Policy (UDRP) and the Rules for Uniform Domain Name Dispute Resolution Policy as adopted by ICANN on 24 October 1999 and as these may be amended from time to time regarding Intellectual Property domain name disputes.

The applicant also undertakes that to the best of his knowledge and belief, neither the License to use the Domain Name nor the manner in which it is directly or indirectly used infringes the legal rights of a third party and that the License to use the Domain Name is not being sought for any unlawful purpose. The Registrar will only give a licence to use a domain name if it is not barred by law such that, it complies with the Laws of Cyprus, including international treaties ratified by the Republic of Cyprus from time to time relating to Intellectual Property issues (e.g. trademark, copyright and famous names issues), as well as the ICANN Dispute Policy.

Registration of the Domain Name does not imply rights with respect to a name or trademark. It is the applicant’s responsibility to ensure that the name applied for does not conflict with third parties’ copyright, trade marks, famous names, or other intellectual property rights or the laws of Cyprus and ICANN Dispute Policy. The registration of a Domain Name, does not constitute acknowledgement of the registrar’s rights in the name contained in the Domain Name, nor authorisation to use the Domain Name in the course of trade.

Domain Name Dispute Resolution

In circumstances where any party challenges the License to use a Domain Name, the Complainant, the Registrant and any other third-party complainants are required to first submit the dispute to the mediation service provided by the Registrar, before the dispute can be submitted to an administrative proceeding under the ICANN Uniform Dispute Resolution Policy. The Complainant, the Registrant and any third parties in the mediation process must pay a fee covering administrative expenses for the mediation amounting to (£200) CY each. This mediation is compulsory. Failure of any of the above persons to engage in the mediation does not negate the obligation to pay the above fee. Failure of the Registrant against whom a complaint has been filed to engage in the mediation will result in the immediate cancellation of the License to use the Domain Name and withdrawal of the Domain Name from the Registry.

In the event that a dispute is not resolved through mediation, the Registrant involved agrees to participate in an administrative proceeding under the ICANN Dispute Resolution Policy, and to comply with the decision reached by the Administrative Panel. If it is found that a Domain Name License has been issued on the basis of untrue, inaccurate or injuriously false statements given by the Registrant, the Registrar may construe this Agreement as void and remove the Domain Name from the Registry. The License to use the Domain Name is also subject to termination or cancellation pursuant to any decision issued by the Administrative Panel under the ICANN Dispute Resolution Policy. The Registrar, will suspend the delegation of a Domain Name upon being informed that dispute resolution proceedings under the ICANN Dispute Resolution Policy have been commenced.

Either the Complainant or the Licensee reserve the right to take their case to the Cyprus Courts if they think that their interests are being violated. NIC CY will comply with the decision reached through either the Arbitration Panel or the legal process. All legal actions come under the jurisdiction of the Cyprus Courts. Injunctions and damages claims can be enforced.

Jurisdiction & Applicable Law

In order for an applicant to register a domain name under the .cy top level domain and obtain a licence to use it in Cyprus, it must appoint an administrative contact who is a permanent resident of Cyprus and who provides evidence to that effect and fulfil all the other application requirements required by NIC CY. Accordingly, if a domain name is registered in Cyprus, if a licensee or other complainant decide to take legal action, such action comes under the jurisdiction of the Cyprus Courts. Nevertheless, the licensee or complainant may also request a decision of one of the ICANN Accredited Panels and comply with any decision reached. If a foreign company has registered a domain name in Cyprus with NIC CY under the .cy top level domain, then the Cyprus Law and ICANN rules will apply according to the terms and conditions of the licence to use the domain name. A person affected by the actions of such a foreign company can apply to a competent Cyprus Court or ICANN accredited Arbitration Panel for the resolution of a dispute.

back to top..