Data Protection Commissioner clarifies rules for CCTV in public spaces

On August 24, 2026, the Cypriot Commissioner for Personal Data Protection, Maria Christofidou, issued a formal clarification regarding the installation of Closed-Circuit Television (CCTV) systems in public spaces by municipal authorities. The Commissioner emphasized that municipalities must conduct a Data Protection Impact Assessment (DPIA) and submit it to the Office of the Commissioner for prior consultation and approval before installing any surveillance equipment.

According to the statement, municipalities are legally permitted under the Municipalities Law to deploy CCTV systems to prevent vandalism, fires, and environmental hazards. However, such measures must comply strictly with the General Data Protection Regulation (GDPR) and national legislation. The installation is deemed a legitimate security and civil protection measure only if it remains necessary and proportionate to the intended purpose, accompanied by appropriate safeguards to protect citizens' personal data.

This clarification comes amidst ongoing public debate regarding the extent of municipal surveillance. While local authorities have the legal authority to prioritize public safety, the Commissioner’s directive serves as a regulatory framework to ensure that privacy rights are not compromised in the process of implementing security measures.