Cyprus parliament removes asset declarations after sensitive data leak

On October 20, 2026, the Cyprus House of Representatives inadvertently published sections of members' "Pothen Esches" asset declarations that are protected by law and exempted from public disclosure. The error occurred during the digital uploading process to the Special Committee’s official website. Upon discovering the breach of privacy, the House removed the documents to rectify the error and prevent further unauthorized distribution of sensitive financial information.

The Office of the Commissioner for Personal Data Protection has since intervened, ordering the removal of the compromised material and associated links from all accessible websites. The Commissioner emphasized that this incident constitutes a data breach under Article 33 of the General Data Protection Regulation (GDPR). The House of Representatives is required to file a formal notification regarding the breach within 72 hours of its discovery.

While the Data Protection Commissioner is currently evaluating the circumstances and the extent of the exposure, initial reports indicate that collaborative corrective measures were taken immediately. The Commissioner's office noted that the investigation process could be accelerated due to the prompt cooperation of the Parliament. The asset declarations are expected to be republished once the sensitive sections have been appropriately redacted and the internal audit is complete.