Cyprus

Cyprus's digital-accessibility regime is built on three legislative layers stacked across a quarter-century. A cross-cutting disability-rights statute — the Persons with Disabilities Law of 2000 (Ο περί Ατόμων με Αναπηρίες Νόμος 127(Ι)/2000) — provides the substantive floor. Public-sector websites and mobile applications have been on the hook since 2018, when Law 119(I)/2018 (Νόμος 119(Ι)/2018) transposed the EU Web Accessibility Directive. Private-sector products and services followed in 2023, when Law 89(I)/2023 (Νόμος 89(Ι)/2023) transposed the European Accessibility Act under the EU-wide application date of 28 June 2025. Article 28 of the 1960 Constitution sits beneath all three.

Geographic scope note. This page covers the Republic of Cyprus — the internationally-recognised state and EU member. Northern Cyprus operates under a separate de facto administration not internationally recognised, with a different legal framework that is outside the scope of this dossier.

The constitutional and treaty floor

The 1960 Constitution of the Republic of Cyprus opens its bill of rights with a general equality clause. Article 28 (Άρθρο 28) provides that "every person is equal before the law, the administration and justice and is entitled to equal protection thereof and treatment thereby" — a formulation that the Supreme Court of Cyprus has read as imposing positive State obligations to eliminate barriers to equal participation, not merely a prohibition on overt differential treatment. The clause is invoked routinely in administrative-court appeals against penalty decisions under the disability-rights statutes, and in constitutional challenges to legislative provisions said to discriminate against persons with disabilities.

Cyprus ratified the UN Convention on the Rights of Persons with Disabilities on 27 June 2011; the Optional Protocol was ratified together with the convention itself. The CRPD entered into force for Cyprus on 27 July 2011, and the convention has direct effect in Cypriot law under Article 169(3) of the Constitution, which gives ratified treaties precedence over conflicting domestic legislation. Article 9 of the CRPD (accessibility) and Article 33 (national implementation and monitoring) are the international-law instruments most frequently cited in Cypriot accessibility-policy documents. The Department for Social Inclusion of Persons with Disabilities is the designated Article 33(1) government focal point; the Commissioner for Administration and Human Rights is the designated Article 33(2) independent monitoring mechanism.

The CRPD Committee's Concluding Observations on Cyprus's Initial Report (2017) flagged the slow pace of accessibility implementation in the built environment, gaps in inclusive education, and the need for stronger enforcement of the equality framework — themes that the 2023 EAA-transposing legislation and the National Disability Action Plan have since attempted to address.

Cypriot Sign Language (Κυπριακή Νοηματική Γλώσσα, CSL) has had formal legal recognition since 2006, when amendments to the Persons with Disabilities Law established the right to CSL interpretation in dealings with public authorities, in judicial proceedings, and in educational settings. CSL is linguistically distinct from Greek Sign Language despite the geographic and cultural proximity of the two communities; it has its own grammar, lexicon, and dialect variation.

The cross-cutting floor: the Persons with Disabilities Law

The Persons with Disabilities Law (Ο περί Ατόμων με Αναπηρίες Νόμος 127(Ι)/2000) is the cross-cutting disability-rights statute, in force since 2000 and amended multiple times — most recently to align with the CRPD ratification (2011) and to clarify the institutional architecture (2017, 2021). The statute defines disability functionally, sets the equal-treatment principle, frames reasonable-accommodation obligations on employers and service providers, establishes the Department for Social Inclusion of Persons with Disabilities (Τμήμα Κοινωνικής Ενσωμάτωσης Ατόμων με Αναπηρίες, DSID) as the implementation focal point, and creates the inter-ministerial coordination mechanism that runs the National Disability Action Plan.

The Persons with Disabilities Law does not itself prescribe technical accessibility standards for websites or products — those sit in the EU-derived statutes — but it provides the cause of action for individual remedies in cases where a public or private actor's failure to comply with accessibility obligations causes harm. Civil claims under L127(I)/2000 can be brought in the District Courts for material and non-material damages, and there is no statutory cap on non-material damages.

Public-sector accessibility: the WAD path via L119(I)/2018

Directive (EU) 2016/2102 — the Web Accessibility Directive (WAD) — was transposed into Cypriot law through Law 119(I)/2018 (Ο περί της Προσβασιμότητας των Ιστότοπων και των Εφαρμογών για Φορητές Συσκευές των Οργανισμών του Δημόσιου Τομέα Νόμος), enacted in 2018 inside the 23 September 2018 EU deadline. The law obliges every public-sector body in the Republic of Cyprus — central government departments, the semi-governmental organisations, local authorities, the public universities (University of Cyprus, Cyprus University of Technology, Open University of Cyprus), publicly-funded hospitals, and the publicly-owned enterprises that fall under the EU's expanded definition of "public sector body" — to make their websites and mobile applications conform to the technical standard set out in the law.

Three concrete obligations follow:

• Conformance. Websites and mobile applications must conform to the harmonised European standard EN 301 549 (currently v3.2.1, integrating WCAG 2.1 Level AA). The national monitoring methodology, published by the Deputy Ministry of Research, Innovation and Digital Policy, fixes the conformance bar at WCAG 2.1 AA pending the formal update of EN 301 549 to track WCAG 2.2.
• Accessibility statement. Each in-scope body must publish, in Greek (and in practice also in English, given Cyprus's bilingual administrative tradition), a structured accessibility statement covering conformance status, content falling outside the directive's scope (third-party widgets, legacy office documents predating September 2018, archived recordings), and a complaint mechanism. The statement must be machine-readable and is filed into the national registry maintained by the Deputy Ministry of Research, Innovation and Digital Policy.
• Feedback and enforcement procedure. Users must be able to submit accessibility complaints to the in-scope body. Unresolved complaints can be escalated to the Deputy Ministry, which acts as the national enforcement body for WAD.

The supervising regulator is the Deputy Ministry of Research, Innovation and Digital Policy (Υφυπουργείο Έρευνας, Καινοτομίας και Ψηφιακής Πολιτικής, DMRID), created in 2020 as a dedicated digital-policy administration carved out of the former Department of Electronic Communications. The DMRID runs the periodic monitoring rounds required by Commission Decision (EU) 2018/1523 (the methodology decision), publishing simplified-scan and in-depth-scan results into the national accessibility-statement registry. The first full Cypriot WAD monitoring cycle was completed in 2022 and the second in 2024; both produced significant findings of partial non-conformance across the central-government estate, with remedial-action timelines averaging 6–9 months per finding.

Private-sector accessibility: the EAA path via L89(I)/2023

The European Accessibility Act — Directive (EU) 2019/882 — was transposed into Cypriot law as a stand-alone statute, Law 89(I)/2023 (Ο περί των Απαιτήσεων Προσβασιμότητας Προϊόντων και Υπηρεσιών Νόμος), enacted in mid-2023 inside the 28 June 2022 transposition deadline (Cyprus missed the deadline by approximately twelve months, putting it among the EU member states that received initial Commission letters of formal notice; the procedure was closed without escalation once L89(I)/2023 was on the statute book). The substantive obligations on businesses took effect on the EU-wide application date of 28 June 2025.

L89(I)/2023 covers the directive's full product and service scope:

• Products: computer hardware and operating systems, self-service terminals (ATMs, ticket machines, check-in kiosks), consumer terminal equipment with interactive computing capability used to access audiovisual media services, consumer terminal equipment used for electronic communications services, and e-readers.
• Services: electronic communications services, services providing access to audiovisual media services, elements of air-, bus-, rail- and waterborne passenger-transport services, consumer banking services, e-books and dedicated software, and e-commerce services.

The law incorporates the directive's micro-enterprise carve-out: businesses with fewer than 10 employees and an annual turnover or balance-sheet total not exceeding €2 million are exempt from the service-side obligations (but not from the product-side obligations, which run on the manufacturer-rather-than-employer test). The transitional period for terminals already in use on 28 June 2025 extends until 28 June 2045 or until the terminal's economically-useful end of life, whichever comes first — a long tail by design, calibrated to the depreciation cycle of bank-branch ATMs and transport-network ticket machines. For Cyprus specifically, the transitional regime is significant because the Cypriot banking sector — concentrated in a small number of large institutions following the 2013 financial crisis — runs a comparatively large ATM-per-capita network that will turn over slowly.

The market-surveillance authority is the Consumer Protection Service (Υπηρεσία Καταναλωτή, CPS) within the Ministry of Energy, Commerce and Industry. The CPS hosts a dedicated EAA market-surveillance team and coordinates with sectoral regulators on the service side: the Central Bank of Cyprus for consumer banking services, the Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR) for electronic communications services, the Civil Aviation Authority and the Department of Merchant Shipping for transport services, and the Cyprus Radio-Television Authority for audiovisual media services. Cross-border market surveillance follows the procedures set out in EU Regulation (EU) 2019/1020 and is coordinated through the EU's Information and Communication System on Market Surveillance (ICSMS).

The cross-cutting backstop: the Combating of Discrimination Law

The Combating of Racial and Other Discrimination (Commissioner) Law (Ο περί Καταπολέμησης των Φυλετικών και Ορισμένων Άλλων Διακρίσεων Νόμος 42(Ι)/2004) — in force since 2004 — equips the Commissioner for Administration and Human Rights (the Cypriot Ombudsman) with a dedicated equality-body mandate. Disability is a protected characteristic under the law, and the Commissioner has the authority to investigate complaints of direct and indirect discrimination, harassment, and failure to provide reasonable accommodation. The act sits alongside the Equal Treatment of Persons in Employment and Occupation Law (L58(I)/2004), which transposed the EU Employment Equality Directive 2000/78/EC into Cypriot law.

The Ombudsman has built a steady caseload of digital-accessibility complaints over the last decade. Decisions involving inaccessible online-banking platforms, inaccessible government e-service portals, and inaccessible e-commerce checkouts have produced public reports recommending remedial action, with the institution's persuasive authority backed up — in cases of refusal — by referral to the Attorney General's office for civil-claim assistance. The Commissioner does not impose administrative fines directly; the enforcement model is recommendation-and-follow-up, supported by published reports and parliamentary oversight. In practice, large institutional respondents comply with the Commissioner's recommendations in the substantial majority of cases.

Technical standards and conformance

The conformance bar across the public-sector (WAD) and private-sector (EAA) tracks is anchored on the same EU harmonised standard, EN 301 549, currently in force at version 3.2.1. EN 301 549 imports WCAG 2.1 Level AA as its baseline web-content conformance requirement and adds further requirements specific to mobile applications, native software, non-web documents, hardware, and communications functionality. The standard's update to integrate WCAG 2.2 is in progress at ETSI and CEN-CENELEC; once published, the DMRID's monitoring methodology and the CPS's market-surveillance guidance are both expected to track the new version on a transitional schedule.

The Council of Ministers' regulations under L89(I)/2023 — adopted in early 2025 — set out the conformity-assessment procedures, the form of the EU Declaration of Conformity required for in-scope products, the technical-file requirements, the CE-marking interaction, and the language regime. Declarations may be issued in Greek (the primary official language) or in English (the second working language of Cypriot business), with a Greek translation provided on request by a competent authority.

For accessibility statements — required under both L119(I)/2018 and L89(I)/2023 — the Commission's Implementing Decision (EU) 2018/1523 model is followed in the public-sector context. The private-sector accessibility-information requirement under L89(I)/2023 is lighter: a structured "information for consumers" notice, in Greek and English in practice, covering how the product or service was made accessible, where to direct accessibility complaints, and which conformance standard was used as a basis.

Penalties — the full exposure stack

The Cypriot enforcement architecture combines administrative fines under the two EU-derived statutes, civil damages under the Persons with Disabilities Law, anti-discrimination recommendations from the Ombudsman, public-procurement disqualification, and EU-level infringement exposure. Below, all figures are in euros — Cyprus has been in the eurozone since 1 January 2008.

Layer 1 — administrative fines under L119(I)/2018 and L89(I)/2023

The EAA's Article 30 obliges every member state to set penalties that are "effective, proportionate, and dissuasive." Cyprus implements this through tiered administrative-fine provisions in L89(I)/2023, with the upper tiers reserved for repeated or systemic violations. L119(I)/2018 sits at the lower end of the range — the WAD's enforcement model has historically prioritised corrective-action orders over high one-off fines.

Cyprus's "very serious" tier ceiling under L89(I)/2023 sits in the middle of the EU-wide spread. By way of comparison: Germany's BFSG §37 caps single-incident fines at €100,000; France's 2023 transposition ordinance allows administrative fines up to €50,000 per non-conforming product, with per-day penalties for ongoing non-compliance; Spain's Ley 11/2023 sets a graduated framework reaching €1,000,000 for "very serious" infringements; Italy's transposition (D.Lgs. 82/2022) caps at €40,000; the Netherlands has signalled exposure of up to 5% of annual turnover for systemic violations. The Cypriot figures published so far position the regime as proportionate to the size of the Cypriot economy while still preserving deterrent effect for large operators in the banking and telecommunications sectors.

Layer 2 — civil damages under the Persons with Disabilities Law

Beyond the administrative-fine track, persons affected by an accessibility-related failure may pursue civil claims in the District Courts for material and non-material damages under L127(I)/2000 and under the general Cypriot tort framework. Cypriot tort law sets no statutory cap on non-material damages — the courts assess them by reference to the severity of the breach, the duration of the conduct, the resources of the respondent, and the broader public-interest implications. Awards in disability-discrimination cases over the last decade have typically fallen in the €1,000–€8,000 range per claimant, with a small number of high-profile cases reaching €15,000–€30,000 where the discriminatory effect on a class of users was well-documented and persistent. Civil and Ombudsman proceedings can run in parallel.

Layer 3 — public-procurement disqualification

The Cypriot Public Procurement Law (L73(I)/2016), transposing the EU Procurement Directives, requires contracting authorities to consider accessibility from the technical-specification stage and allows for disqualification of bidders that have been found to have committed serious professional misconduct — a category that includes adjudicated accessibility-related discrimination decisions and significant administrative-penalty findings under L89(I)/2023. For vendors selling into the Cypriot public sector, the loss of bid eligibility on an active procurement (typical contract values €200,000 to several million euros for the larger central-government and university procurements) routinely exceeds the administrative fine that triggered the disqualification by one to two orders of magnitude.

Layer 4 — consumer-protection collective claims

Cyprus does not yet have a US-style accessibility class-action regime, but the Cypriot Civil Procedure Rules permit representative claims under Order 9 for the protection of consumer interests, and consumer-protection organisations may pursue collective actions through the District Courts. A digital service that systematically excludes a class of users with disabilities can give rise to such a claim, with damages assessed on a per-claimant basis and added together. The route remains under-used in Cypriot practice but is increasingly invoked in EU member states with comparable procedural frameworks.

Layer 5 — EU Commission infringement procedures (state-level)

The largest exposure number in the EU accessibility landscape is not a fine on a business — it is the lump-sum and daily penalty the Court of Justice of the European Union can impose on a member state under Article 260(2) TFEU for failing to transpose or enforce an EU directive. The 2025 Commission communication on financial sanctions sets the indicative minimum lump-sum payment for failure to comply with a previous CJEU judgment at €612,000 for Cyprus, with daily penalty payments calculated from a base of approximately €600–€4,000 per day multiplied by severity and duration coefficients. Cyprus has been the target of a Commission letter of formal notice in 2022 for delayed EAA transposition; the procedure was closed when L89(I)/2023 was enacted. An enforcement-stage infringement procedure on either the WAD or the EAA track remains a credible 2026–28 risk if the national enforcement infrastructure lags. The pressure of an open Commission procedure routinely produces a step-change in how aggressively the national regulator uses its existing administrative-fine powers.

Enforcement record and outlook

Public-sector enforcement under L119(I)/2018 has been steady but measured: the DMRID's monitoring methodology produces twice-yearly simplified scans of around 600 in-scope websites (the Cypriot public-sector estate is small relative to the larger EU member states) and a smaller in-depth-scan tranche of approximately 20 sites per cycle. Findings of non-conformance trigger remedial-action orders in the first instance, with administrative penalties reserved for repeat offenders or for cases where the public-sector body refuses to engage. The 2022 and 2024 monitoring cycles produced significant findings across the central-government estate; the 2026 cycle is expected to follow the same pattern, with particular focus on the e-services portals run under the gov.cy umbrella.

Private-sector enforcement under L89(I)/2023 started only on 28 June 2025 and is in its first surveillance cycle as of mid-2026. The Consumer Protection Service's market-surveillance programme prioritises (per its published 2025–2026 work plan): banking-app accessibility (a particular focus given the post-2013 sector consolidation), e-commerce checkout accessibility, self-service ticketing kiosks at Larnaca and Paphos airports and at the major bus-station hubs, and e-book reader devices placed on the Cypriot market. The first round of administrative-penalty decisions under L89(I)/2023 is expected through late 2026; current expectation in the regulatory community is that the CPS will give regulated entities a short formal grace period (typically a 60-day corrective-action window) before assessing penalties, except in cases of egregious or repeated non-compliance.

The Ombudsman's caseload on digital-inaccessibility-as-discrimination has been the most active enforcement strand of the three for the last decade. Decisions in 2024 and 2025 involving inaccessible online-banking interfaces and inaccessible municipal portals have produced public reports with detailed remedial recommendations. Compliance with the Ombudsman's recommendations has historically been high among public-sector respondents and somewhat more variable among private-sector respondents, though the 2023 enactment of L89(I)/2023 — with its administrative-fine teeth — has visibly raised the compliance rate on the private side.

What's coming in 2026–27

Three concrete developments to watch. First, the Council of Ministers' secondary regulations under L89(I)/2023 are being operationalised through 2026: detailed technical-file content requirements, the form of the EU Declaration of Conformity for in-scope products, and the procedure for designating notified bodies under the EAA's conformity-assessment regime. Second, the DMRID has announced (early 2026) an updated national accessibility methodology designed to align Cyprus's WAD monitoring with WCAG 2.2 once EN 301 549 formally tracks the new version. Third, the National Disability Action Plan 2024–2028 — adopted in late 2024 by the Council of Ministers — sets out the cross-government implementation pathway across the DSID, the DMRID, the CPS, and the Ombudsman, with annual progress reporting to the House of Representatives.

On the international-monitoring side, Cyprus's next periodic report to the CRPD Committee is due in 2027, and accessibility implementation under both the WAD and the EAA pathways will feature prominently in the next round of Concluding Observations. The Ombudsman's CRPD Article 33(2) independent-monitoring reports — published annually — are the most detailed contemporaneous record of implementation gaps and are routinely cited by the CRPD Committee in its review process.