O peri tou Dikaiomatos Prosvasis se Plirofories tou Dimosiou Tomea Nomos tou 2017 (The Right of Access to Information in the Public Sector Law of 2017)

Response Timeline

Under Article 12, public authorities must process requests within 30 calendar days from the date of receipt. The deadline may be extended up to a total of 50 days (i.e. 20 additional days) where provided for by Regulations, such as when the volume of information is substantial or consultation with third parties is necessary (Article 14). The authority must notify the requester in writing of the reasons for any extension before the original 30-day deadline expires. The period between a fee notification and the requester's payment does not count toward the 30-day deadline (fee payment window is a maximum of 3 months). If a public authority fails to respond within 30 days, the requester has 14 days from the expiry of the deadline to file a complaint with the Information Commissioner (Article 42).

How to Submit a Request

Accepted Methods

• {'notes': 'By post or delivered in person to the competent public authority. Some departments provide a standard request form on their websites.', 'method': 'written'}
• {'notes': 'Requests may be submitted by email to the competent authority (Article 8).', 'method': 'email'}

Requests must be in writing (Article 8) but no official form is required and the request need not cite the law or state reasons for seeking the information (Article 9). The law applies to any natural or legal person regardless of nationality or residency (Article 3). Requests should be directed to the specific public authority believed to hold the information. The authority must inform the requester in writing or by email whether it holds the requested information.

Required Elements

• Full name of the applicant (Article 9)
• Contact address -- postal or email address (Article 9)
• Description of the information sought (Article 9)

Fees

Article 11 authorises public authorities to charge fees set by regulations or special law. The authority must notify the applicant in writing of the fee amount within the 30-day response period. Fees are limited to the reasonable cost of reproduction and delivery. The applicant has 3 months to pay; if unpaid, the obligation to provide information is discharged. As of 2026, no implementing regulations specifying fee schedules have been published, leaving fee-setting discretion to individual authorities. RTI Rating scored 0/2 on free requests (indicator 3.12) and 1/2 on fee structure standards (indicator 3.13).

Exemptions

• Information accessible by other means (Art. 20)
  Information to which the applicant has reasonable access through other methods. Absolute exception -- no public interest override.
• Information intended for future publication (Art. 21)
  Information held by a public authority for the purpose of its publication. Subject to public interest override.
• Security bodies information (Art. 22)
  Information related to or provided by security forces. Absolute exception -- blanket exclusion with no harm test or public interest override.
• National security (Art. 23)
  Information whose disclosure may affect the protection of national security. No harm test required. Subject to public interest override.
• Defence (Art. 24)
  Information whose disclosure may undermine the defence of democracy or the Republic. Subject to public interest override.
• International relations (Art. 25)
  Information relating to the relationship of the Republic with other states or international organisations. Subject to public interest override.
• Economic interests (Art. 26)
  Information whose disclosure could harm the economic or financial interests of the Republic. Subject to public interest override.
• Investigations by public authorities (Art. 27)
  Information collected in the context of investigations and procedures. No harm test required. Subject to public interest override.
• Law enforcement (Art. 28)
  Information whose disclosure could prejudice law enforcement activities. Subject to public interest override.
• Judicial/court records (Art. 29)
  Information contained in court or judicial records. Absolute exception -- no public interest override.
• Audit functions (Art. 30)
  Information used in the context of auditing of accounts or examinations of economy, efficiency, and effectiveness. Subject to public interest override.
• Parliamentary privilege (Art. 31)
  Information protected by parliamentary privilege. Absolute exception -- no public interest override.
• Government policy development (Art. 32)
  Information related to ministerial communications or advice by the Attorney General. No harm test required. Subject to public interest override.
• Health and safety (Art. 33)
  Information whose disclosure could endanger public health or safety. Subject to public interest override.
• Commercial interests and confidential information (Art. 34)
  Art. 34(1) confidential information is absolute (no override). Art. 34(2) commercial interests are subject to public interest override.
• Personal data (Art. 3(3) scope exclusion)
  Requests concerning personal data governed by Data Protection Law 125(I)/2018, not the RTI law. Complete scope carve-out.

Exceptions are in Part III (Arts. 19-34). Article 19(4) establishes two tiers: absolute exceptions (Arts. 20, 22, 29, 31, Art. 34(1)) where no public interest override applies, and non-absolute exceptions (Arts. 21, 23-28, 30, 32-33, Art. 34(2)) where the public interest in maintaining the exception must outweigh the public interest in disclosure. NO harm test is required for national security (Art. 23), investigations (Art. 27), court records (Art. 29), policy development (Art. 32), or confidential information (Art. 34(1)). NO severability/partial access clause exists. Article 3(3) creates complete scope carve-outs for personal data, matters regulated by other legislation, EU obligations, and contempt of court. RTI Rating: 14/30 on Exceptions, noting three non-standard exceptions (security bodies, parliamentary privilege, information given in confidence) and the reverse hierarchy where other legislation trumps the RTI law.

Appeal Process

Cyprus has NO internal review mechanism within public authorities (RTI Rating indicator 36: 0/2). The first avenue is a complaint to the Information Commissioner (Art. 42), whose decisions are binding (Art. 44). An objection/reconsideration step exists (Art. 45). Final judicial review via the Administrative Court under Constitution Art. 146 (75-day absolute deadline). The Commissioner role is held by the Commissioner for Personal Data Protection. As of January 2025, 78 complaints had been filed since the law took effect in December 2020. No fines had been imposed as of that date. Appeals category score: 18/30.

Sources & References

• Full text of law →
• Primary source →
• RTI Rating - Cyprus →
• Information Commissioner of Cyprus →
• CyLaw - Law 184(I)/2017 Index →
• EuroPAM - Cyprus →
• Cyprus Mail - Right to know law: 4 years on (Jan 2025) →