Through the Circular, CySEC informs the Regulated Entities that they are legally obliged to notify to the Commissioner of the Protection of Personal Data (the “Commissioner”), by 30.04.17, the information provided in article 7 of the Law regarding the processing of personal data. Particularly:
- The Law applies to any processing of personal data which form part of a filing system or are intended to form part of a filing system and where this processing is performed by a controller established in the Republic. To this extent, it is hereby clarified that any Regulated Entity that performs such processing falls under the term of controller.
- In accordance with the provisions of article 7(1) of the Law: “The controller must notify the Commissioner in writing about the establishment and operation of a filing system or the commencement of processing.”
CySEC’s expects that: The Regulated Entities shall immediately comply with the above mentioned requirement in case they have not responded so far by filling and submitting to the Commissioner, in relation to their clients’ records, the:
- General Notification Form for the ‘Establishment and Operation File / Start Processing’; and
- Specific Notification Form for the ‘Established and Operation File / Start Processing for Closed Circuit Video Surveillance’, where relevant.
The General and Specific Notification Forms (the “Forms”) are available only in Greek. Instructions for filling out the Forms can be found at the end of each Form, and for any inquiries in completing the Forms, please contact the Commissioner’s Office at: (+357) 22 818456. The Forms can be submitted via any of the following methods:
- Post / Address: P.O. Box 23378, 1682 Nicosia;
- Email: commissioner@dataprotection.gov.cy,
- Fax: (+357) 22 304565.