Is cold email legal in Cyprus? B2B rules 2026

No, not without prior consent, even when the recipient is a company. Section 106(1) of Cyprus Law 112(I)/2004 requires prior consent for marketing email to individuals, and a 2005 Order extends the rule to companies: the data protection Commissioner's 2023 guidance says consent must also be obtained from legal persons. The Order allows marketing email to a company only if it has declared that it wants such messages. The Commissioner also says addresses found online cannot be used and that a message asking for consent is itself unlawful. Existing customers who are individuals can get offers for your own similar products; for company customers, law firms disagree. We found no guidance on LinkedIn messages and no published decision on B2B email.

Checked on 2 November 2026 against the consolidated law text, the 2005 Order, archived copies of the Commissioner's guidance and published secondary reports. This is not legal advice.

Cyprus sits with Greece, Poland, Austria and Germany: consent first, even in B2B. All countries: cold email laws by country.

Cyprus at a glance

What the law says

The ePrivacy Directive is implemented in the Regulation of Electronic Communications and Postal Services Law of 2004, 112(I)/2004. The consolidated text on CyLaw, the Pancyprian Bar Association's database, lists amendments up to 23(I)/2022, and its index of laws shows none since. Section 106(1):

"Η χρησιμοποίηση ... ηλεκτρονικού ταχυδρομείου για σκοπούς απευθείας εμπορικής προώθησης επιτρέπεται μόνο στην περίπτωση συνδρομητών ή χρηστών, οι οποίοι έχουν δώσει εκ των προτέρων τη συγκατάθεσή τους."

Our translation: "The use of ... electronic mail for the purpose of direct commercial promotion is permitted only in the case of subscribers or users who have given their prior consent."

Then comes the catch. Section 106(5) says: "Τα εδάφια (1) και (3) ισχύουν για τους συνδρομητές που είναι φυσικά πρόσωπα" (subsections (1) and (3) apply to subscribers who are natural persons). For everyone else the Law sends you to a separate instrument, the Order on Legal Persons (Safeguarding Legitimate Interests regarding Unsolicited Communications) of 2005, issued by the telecoms regulator and published as KDP 34/2005 in the Official Gazette of 28 January 2005. The Order defines a subscriber as a legal person that has a contract with a public electronic communications provider (art. 2). Article 5 allows marketing email to such subscribers only where they have:

• declared that they wish to receive such messages from that sender, or
• declared so in the Cyprus telephone directory database (we could not confirm that it operates today), or
• told their email provider that they want such messages.

The persons named in those three limbs must "ζητούν με σαφή τρόπο" (clearly ask) for the subscriber's consent, obtained in printed or electronic form. Unsolicited marketing by other means needs prior consent (art. 6).

In our reading the Order is still in force: § 106(5) points to it, the Commissioner's 2023 guidance applies it, and CyLaw's indexes of regulatory acts to October 2026 list no amendment or repeal.

Section 106(4) also bans marketing email that hides the sender or has no "έγκυρη διεύθυνση" (valid address) for stop requests.

A 2026 bill leaves § 106 alone. Open for comment until 16 September 2026, it adds an AI directorate to the telecoms regulator and amends only sections 2, 14 and 153 and the preamble.

What the regulators say

The Commissioner for Personal Data Protection's site denied our requests, so we read its guidance in Internet Archive copies. Its guidance on direct marketing, dated August 2023, says the consent rules of § 106 apply to subscribers who are natural persons, and that for other subscribers the 2005 Order applies, "με βάση το οποίο θα πρέπει να λαμβάνεται συγκατάθεση και από νομικά πρόσωπα" (under which consent must also be obtained from legal persons; guidance, archived copy, our translation), still listed in May 2025. It adds that an unsubscribe option alone does not make sending lawful: recipients must have consented or be customers.

A notice of 16 February 2024 (archived copy) makes two more points. Contact details "από πηγές προσβάσιμες στο κοινό" (from publicly accessible sources), such as addresses posted online, cannot be used for advertising messages. And a message asking for consent "δεν είναι νόμιμη" (is not lawful), because it is itself promotion without consent. Neither text mentions info@ addresses or B2B email by name, and we found no OCECPR guidance on marketing email.

Law firm guides differ. Chambers & Co (9 April 2025) calls a generic address "permissible if no personal data is involved" and does not mention the 2005 Order (Chambers & Co); in our reading, that answers only the GDPR question. Linklaters' Cyprus guide (updated June 2026) says the Order permits marketing email to legal persons "only where a subscriber has clearly declared, in written or electronic form, its willingness to receive such mail" (Linklaters).

Named employees, sole traders and the first email

Named employees. Neither text says whose consent counts for firstname.lastname@company. Our reading: it makes no difference, since § 106(1) requires consent if the address is the person's and the Order does if it is the company's.

Sole traders are natural persons, so § 106(1) applies; no guidance found that treats them differently.

Can a first email ask for consent? No. The Commissioner's notice of 16 February 2024 says a message asking for consent is not lawful, because it promotes services without consent. The notice does not single out companies; our reading is that it applies in B2B too, since the Order requires the company's declaration first. Collect consent through a sign-up form or an inbound inquiry.

Existing customers

Section 106(2) is the soft opt-in:

"... μπορεί να χρησιμοποιεί τα εν λόγω στοιχεία για την απευθείας εμπορική προώθηση των δικών του παρόμοιων προϊόντων ή υπηρεσιών, υπό την προϋπόθεση ότι οι πελάτες του έχουν σαφώς και ευδιάκριτα την ευκαιρία να αντιτάσσονται, δωρεάν και εύκολα ..."

Our translation: the sender "may use those details for direct promotion of its own similar products or services, provided its customers have the clear and distinct chance to object, free of charge and easily". The chance to object must come at collection and with every message. It covers people who bought from you, not prospects.

For company customers, the sources disagree. Linklaters says the exception applies "in respect of individual as well as corporate subscribers", and § 106(5) limits only subsections (1) and (3) to natural persons. Chambers & Co says it applies "only to natural persons, not legal entities". The Commissioner's 2023 guidance describes the exception, then says those rules apply to natural persons and that companies fall under the Order, which has no customer exception. Our reading: rely on it for individuals and sole traders, and get consent from company customers.

LinkedIn and social media messages

No guidance found from a regulator or court on LinkedIn or social media DMs. The Order defines unsolicited communications as those over electronic communications networks without the recipient's consent, including email and SMS (art. 2, our translation). Politis reported on 2 April 2026, citing the Commissioner's election guidance, that political messages through Viber or WhatsApp need prior consent (Politis). Our reading: a LinkedIn DM to a Cypriot recipient needs the same consent as an email.

GDPR and the two regulators

Under § 107(2) the Commissioner for Personal Data Protection handles possible breaches of § 106, using the powers of § 107A. OCECPR, the office of the telecoms regulator (the Law now calls its head the Commissioner of Communications), may order a breach of Part 14 to stop and impose the Law's sanctions, subject to § 107(2) (§ 107(1)), and Order art. 8 applies § 107 to breaches of the Order. We found no guidance on which authority takes a company's complaint.

GDPR applies alongside. A name plus a work address is personal data, and you must say where you got it "at the latest at the time of the first communication" (Article 14(3)(b) GDPR). Legitimate interest covers the data, not the sending: the Commissioner's 2023 guidance applies the Law to electronic marketing as the more specific rule and discusses legitimate interest only for post and live calls. More in GDPR and B2B email under legitimate interest.

Fines and real cases

For breaches of Part 14, which includes § 106, the Commissioner for Personal Data Protection can warn, reprimand, order the breach to stop, ban processing or fine up to EUR 200,000 (§ 107B, added in 2022); all but a warning require a hearing first. OCECPR can fine breaches of the Order (art. 8(2)); its 2008 fines order caps such fines at EUR 170,800, or EUR 341,720 for a repeated breach, unless the Law provides otherwise (KDP 300/2008, art. 9(1)). Anyone affected can also go to court (§ 106(6)).

We found no published decision against a sender of B2B email. What exists:

• Workload: in May 2024 the Commissioner said her office had handled 2,585 complaints in the six years since GDPR applied, 746 of them about unsolicited advertising messages, and imposed fines totalling EUR 1.561 million (Cyprus Mail, 24 May 2024). The fines cover all complaint types.
• Election campaigns: fines of EUR 1,000 to EUR 36,000 per campaign for unsolicited calls and SMS in 2023 and 2024 (Politis, 2 April 2026). The recipients were voters.
• Email without consent: Linklaters reports a fine of EUR 8,000 on a person who repeatedly sent direct marketing email without prior consent and without a sender identity or opt-out address. It gives no date or name.

Checklist for B2B email to Cyprus

1. Get a declared wish to receive your messages from the company before the first email, and record when and how you got it.
2. Do not use addresses found online, and treat named work addresses like info@: consent first.
3. Do not email anyone to ask for consent.
4. Existing customers: individuals and sole traders only, your own similar products, with an opt-out at collection and in every message.
5. Name the sender and include a working unsubscribe (§ 106(4)).
6. Inform people under GDPR Article 14 and keep a suppression list.

How Leo handles Cyprus

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Cyprus has no such rule. Cypriot law protects companies through the 2005 Order, and in review mode, the default, you read and approve every draft, so whether a Cypriot company has declared it wants your messages is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Cypriot consent for you.

More countries: Estonia, Greece, Hungary, Romania, Slovakia, Bulgaria, Croatia, Lithuania, Slovenia, Latvia, Malta and Iceland.

Common questions

Is B2B cold email legal in Cyprus?

No, not without prior consent. Section 106(1) of Law 112(I)/2004 requires consent from individuals, and the Commissioner's 2023 guidance says that under Order 34/2005 consent must also be obtained from companies.

Can I email a Cypriot company's info@ address without consent?

No. The Commissioner says companies must consent too, and the Order has no exception for generic addresses. A law firm guide that calls info@ permissible addresses only the GDPR, in our reading.

Can I send a first email asking for consent in Cyprus?

No. The Commissioner's notice of 16 February 2024 says a message asking for consent is not lawful, because it is itself promotion without consent.

Are LinkedIn messages covered in Cyprus?

We found no guidance naming LinkedIn. The Order covers unsolicited communications over electronic networks, so in our reading a sales DM follows the email rule.

What are the fines for cold email in Cyprus?

Up to EUR 200,000 from the Commissioner for Personal Data Protection under the Law. For breaches of the 2005 Order, OCECPR's fines order allows up to EUR 170,800, or EUR 341,720 if repeated. We found no published fine against a B2B sender.