> ## Documentation Index
> Fetch the complete documentation index at: https://docs.botbrains.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Cold Calling Laws in Cyprus

> Is AI cold calling legal in Cyprus? Art. 106 of Law 112(I)/2004 needs prior consent for automated calls, B2C and B2B. No do-not-call list, recording, AI rules.

export const reviewed_0 = "October 2026"

In Cyprus, an AI agent may only make marketing calls to people and companies who agreed to them beforehand. [Article 106 of Law 112(I)/2004](https://www.cylaw.org/nomoi/enop/non-ind/2004_1_112/full.html) requires prior consent for direct marketing by automated calling systems, and a 2005 decree applies the opt-in rule to companies. Cyprus has no do-not-call register, so list screening never replaces consent. The Commissioner for Personal Data Protection enforces the rules.

<Note>
  This page summarizes the law as of {reviewed_0} to help you plan AI phone calls. It isn't legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.
</Note>

## At a glance

| Call | To consumers (B2C) | To businesses (B2B) |
| - | - | - |
| Inbound service call | <Icon icon="circle-check" color="#16a34a" /> Allowed. Disclose the AI and ask before you record. | <Icon icon="circle-check" color="#16a34a" /> Allowed. Disclose the AI and ask before you record. |
| Outbound service call | <Icon icon="circle-check" color="#16a34a" /> Allowed. Mentioning an offer makes it a marketing call. | <Icon icon="circle-check" color="#16a34a" /> Allowed |
| Marketing callback the person asked for | <Icon icon="circle-check" color="#16a34a" /> Allowed. Keep proof of the request. | <Icon icon="circle-check" color="#16a34a" /> Allowed. Keep proof of the request. |
| Marketing call by an AI agent | <Icon icon="signature" color="#d97706" /> Consent required | <Icon icon="signature" color="#d97706" /> Consent required. The 2005 decree covers companies. |
| Marketing call by a human to existing customers | <Icon icon="circle-dashed" color="#6b7280" /> Unclear. The statute points to consent, while the Commissioner applies the GDPR. Get consent to be safe. | <Icon icon="signature" color="#d97706" /> Consent required. The 2005 decree has no customer exception. |
| Cold marketing call by a human | <Icon icon="signature" color="#d97706" /> Consent required. Legitimate interest only works where you already have a relationship. | <Icon icon="signature" color="#d97706" /> Consent required under the 2005 decree |

## Is AI cold calling legal in Cyprus?

Only with prior consent. Article 106(1) covers «αυτόματων συστημάτων κλήσης και επικοινωνίας χωρίς ανθρώπινη παρέμβαση» used for direct marketing. It permits them only for subscribers or users who «έχουν δώσει εκ των προτέρων τη συγκατάθεσή τους». In English: automated calling and communication systems without human intervention need the prior consent of the person called.

**The rule reaches companies too.** Article 106(5) applies these consent rules to natural persons, which includes sole traders. For legal persons, it points to the [Legal Persons (Unsolicited Communications) Decree of 2005](https://ocecpr.ee.cy/images/files_uploads/agora/nomothesia/diatagmata/EC_Order_LegalEntitiesUnsolicitedCommunications_GR_KDP-34-2005_28-01-2005_EK1.doc_0.doc) (ΚΔΠ 34/2005). Its Article 4 permits automated marketing calls to a company only if the company declared that it accepts them. You must ask clearly and get the consent on paper or electronically. The Commissioner's [2023 direct marketing guidance](https://www.gov.cy/media/sites/67/2025/09/%CE%9F%CE%B4%CE%B7%CE%B3%CE%AF%CE%B5%CF%82-%CE%B3%CE%B9%CE%B1-%CE%B1%CF%80%CE%B5%CF%85%CE%B8%CE%B5%CE%AF%CE%B1%CF%82-%CE%B5%CE%BC%CF%80%CE%BF%CF%81%CE%B9%CE%BA%CE%AE-%CF%80%CF%81%CE%BF%CF%8E%CE%B8%CE%B7%CF%83%CE%B7-2023-v1.1.pdf) confirms that companies must consent as well.

**AI agents most likely count.** The Commissioner describes automated calls as calls «με ηχογραφημένο μήνυμα» (with a recorded message) on its [complaints page](https://www.gov.cy/dataprotection/plirofories-gia-polites/apeytheias-emporiki-proothisi/). No Cypriot authority or court has ruled on conversational AI agents. An AI agent that runs the call alone has no human intervention, so treat it as automated. A human who supervises changes little in Cyprus, because calls by a human need consent as well.

## Cold calls by a human

Cyprus chose opt-in for calls by a human too. Article 106(3) tells the telecom regulator to make sure that other unsolicited marketing calls «δεν επιτρέπονται χωρίς τη συγκατάθεση» of the subscribers or users. In English: they aren't allowed without consent. For companies, the 2005 decree requires prior consent for marketing by any other means, and it defines unsolicited communications to include voice calls.

**The Commissioner reads it slightly differently.** Its 2023 guidance applies the GDPR to calls by a human. You then need consent or legitimate interest ([GDPR Art. 6(1)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Legitimate interest needs a relevant relationship, such as an existing customer, and a documented balancing test. A stranger on a cold list has no such relationship, so you need consent under either reading.

The guidance also bans calling numbers generated at random by software, whether by a human or electronically.

## Existing customers and callback requests

**Existing customers.** Article 106(2) lets you market similar products to customers whose email address you collected in a sale, if they could object then and in every message. The statute names email only. The Commissioner applies the exception to SMS as well, and its [2024 political guidance](https://www.gov.cy/media/sites/67/2025/09/%CE%A0%CE%BF%CE%BB%CE%B9%CF%84%CE%B9%CE%BA%CE%AE-%CE%B5%CF%80%CE%B9%CE%BA%CE%BF%CE%B9%CE%BD%CF%89%CE%BD%CE%AF%CE%B1-%CF%80%CF%81%CE%BF%CF%8E%CE%B8%CE%B7%CF%83%CE%B7-%CF%85%CF%80%CE%BF%CF%88%CE%B7%CF%86%CE%B9%CE%BF%CF%84%CE%AE%CF%84%CF%89%CE%BD-2024.pdf) even mentions calls. Don't rely on it for AI calls. The 2005 decree has no customer exception for companies. Your customer relationship doesn't extend to your parent or sister companies either.

**Calls by a human to existing consumer customers.** Cypriot law points two ways here. Article 106(3) requires consent for every marketing call outside the rules for automated calls and email, and a call by a human to a customer falls under neither. But Article 106(3) only tells the OCECPR to take measures, and the only decree on unsolicited communications that the [OCECPR lists](https://ocecpr.ee.cy/nomothesia/ethniki-nomothesia/ilektronikes-epikoinonies/diatagmata?start=50) covers companies. [Linklaters](https://www.linklaters.com/en/insights/data-protected/data-protected---cyprus) therefore reads Cypriot law as silent on calls to consumers and applies only the GDPR, and the Commissioner's 2023 guidance does the same. We found no Cypriot decision that extends Article 106(2) to calls or accepts legitimate interest for marketing calls to current customers. Get consent if you can. If you rely on legitimate interest instead, mirror Article 106(2). Call only current customers about your own similar products, and offer an opt-out when you collect the number and on every call. Document a balancing test and honor every objection ([GDPR Art. 21](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Leave former customers out. In February 2023, the Commissioner fined Epic EUR 3,250 under GDPR Art. 6(1) for calls to 332 former customers without a valid legal basis ([GDPR Enforcement Tracker](https://www.enforcementtracker.com/ETid-1818)).

**Callbacks.** The rules cover unsolicited calls, and the 2005 decree defines those as calls made without the consent of the person called. A call the person asked for falls outside them. Keep proof of the request and stay on its topic. A landing page where people leave their number and agree to a call from your AI agent works, if the form says an AI agent will call.

**Service calls.** Reminders, delivery updates, and support follow-ups aren't marketing. The Commissioner rejects the excuse that an unsolicited message was "just information" when it names a company, product, or service. Keep service calls to the service and leave offers out.

## Do-not-call register: None

Cyprus has no national do-not-call register, and the Commissioner's guidance doesn't mention one. Because marketing calls need consent, there's no list that makes a call lawful. You need proof of consent for every number.

Keep your own suppression list of everyone who withdrew consent or objected ([GDPR Art. 21](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Use [guidance](/concepts/guidance) to tell the AI agent how to handle requests to stop calling, and a [Unitool](/concepts/unitools) to write each objection to your CRM. botBrains doesn't screen lists for you.

## Consent for AI calls

The Commissioner's 2023 guidance sets these requirements:

| Requirement | What it means |
| - | - |
| Prior and express | Get it before the first call, through a clear statement or positive action. Silence or inaction isn't consent. |
| From the person called | The holder of the number gives it to you directly, not a third party. |
| Specific and informed | Name your company, say that an AI agent will call, and state the purpose. |
| Written or electronic for companies | The 2005 decree asks for consent on paper or in electronic form. |
| Provable | You carry the burden of proof. Record the date, time, and method for each contact and keep a consent register. |
| Revocable | People can withdraw at any time. Stop calling at once. |

Cypriot law sets no expiry date for consent and no retention period for consent records. Keep the evidence while you rely on it and long enough to answer complaints.

**Purchased lists.** Consent must come from the person to you, so a generic "partners" opt-in from a data vendor doesn't cover AI calls from you. The EDPB says a consent form must name every company that relies on it ([Guidelines 05/2020](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en), para. 65). Ask any vendor for the exact consent text, the collection method, and evidence per contact.

**Calls for a partner.** The company whose products you promote is usually the controller. A call center or agency working for it needs a processing contract under [GDPR Art. 28](https://eur-lex.europa.eu/eli/reg/2016/679/oj).

Before you start, read [what botBrains needs for outbound campaigns](/concepts/phone/countries#before-you-start-outbound-campaigns).

## Tell callers they're talking to an AI

Since August 2, 2026, [Article 50 of the EU AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#art_50) requires that people know they're talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can't count on the exception for obvious cases when your AI agent sounds human. The [default introduction](/concepts/phone#introductions) already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the [Consumer Rights Directive](https://eur-lex.europa.eu/eli/dir/2011/83/oj/eng) also requires you to name your company, anyone you call for, and the commercial purpose at the start.

Cypriot consumer law adds rules for the opening of the call:

| Rule | Applies to |
| - | - |
| State your identity, the company you call for, and the commercial purpose at the start ([Consumer Protection Law 112(I)/2021, Art. 19(5)](https://www.cylaw.org/nomoi/enop/non-ind/2021_1_112/full.html)) | Calls to consumers to conclude a distance contract |
| State your identity and the commercial nature of the call at the start, and say if you record it (Art. 27A(3), added by [Law 30(I)/2026](https://www.cylaw.org/nomoi/arith/2026_1_030.pdf) from June 19, 2026) | Financial services sold at a distance |

A draft Artificial Intelligence Law of 2026 went to public consultation in August 2026. It sets up the national authorities for the EU AI Act and adds no separate Cypriot AI rules ([Politis](https://en.politis.com.cy/life/tech/1026739/cyprus-moves-to-implement-eu-ai-rulebook)).

A recommended [introduction](/concepts/phone#introductions) for outbound marketing calls, in Greek:

```text theme={null}
Γεια σας. Εδώ {agent_name}, πράκτορας τεχνητής νοημοσύνης της εταιρείας {project_name}. Σας καλούμε επειδή συμφωνήσατε να επικοινωνήσουμε μαζί σας για [σκοπός της κλήσης]. Θα θέλαμε να καταγράψουμε την κλήση για να τεκμηριώνεται η συνομιλία μας. Αν δεν συμφωνείτε, πατήστε τον αστερίσκο οποιαδήποτε στιγμή. Αν δεν θέλετε να σας ξανακαλέσουμε, απλώς πείτε το μου.
```

In English:

```text theme={null}
Hello, this is {agent_name}, an AI agent calling for {project_name}. We're calling because you agreed to hear from us about [purpose of the call]. We'd like to record this call to document our conversation. If you don't agree, press the star key at any time. If you don't want us to call again, just tell me.
```

For inbound calls, in Greek and English:

```text theme={null}
Γεια σας. Εδώ {agent_name}, πράκτορας τεχνητής νοημοσύνης της εταιρείας {project_name}. Θα θέλαμε να καταγράψουμε την κλήση για να τεκμηριώνεται η συνομιλία μας. Αν δεν συμφωνείτε, πατήστε τον αστερίσκο οποιαδήποτε στιγμή. Πώς μπορώ να σας βοηθήσω;
```

```text theme={null}
Hello, this is {agent_name}, the AI agent of {project_name}. We'd like to record this call to document our conversation. If you don't agree, press the star key at any time. How can I help you?
```

## Call recording

**Criminal law.** [Law 92(I)/1996](https://www.cylaw.org/nomoi/enop/non-ind/1996_1_92/full.html) makes it a crime to intercept or monitor a private communication. Its definition of monitoring includes «μαγνητοφώνηση ή οποιασδήποτε άλλης μορφής καταγραφή» (tape recording or any other form of recording). Article 3(2)(α) exempts recordings with the prior express approval of both the caller and the person called. We found no Cypriot source that settles whether this applies to a party recording its own call, so treat Cyprus as all-party consent.

**Telecom law.** [Article 99(2) of Law 112(I)/2004](https://www.cylaw.org/nomoi/enop/non-ind/2004_1_112/full.html) bars anyone other than the people on the call from recording it without their consent. Article 99(4) leaves room for recordings that the law permits in lawful business practice as evidence of a transaction or other business communication.

**Data protection.** You also need a lawful basis and must tell the caller the purpose and retention ([GDPR Art. 6 and 13](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Recording a voice isn't biometric processing unless you use it to identify the person ([GDPR Art. 4(14) and 9](https://eur-lex.europa.eu/eli/reg/2016/679/oj)).

Announce the recording in the first sentence, before the conversation starts. For the strongest position, have the agent ask whether the caller agrees, and ask anyone who says no to press the star key. The star key stops the recording and discards it, but the transcript stays. Law 92(I)/1996 counts any form of recording, so a transcript may count too. Decide whether you need to keep it after an objection. botBrains stores recordings, transcripts, and call data in the EU.

## Caller ID and calling hours

The caller sees your botBrains phone number, and botBrains provides Cypriot numbers on request. Under [Article 102(3) of Law 112(I)/2004](https://www.cylaw.org/nomoi/enop/non-ind/2004_1_112/full.html), people can reject calls that hide the calling number, so always show it. We found no Cypriot rule on calling hours, call frequency, or a special prefix for marketing calls. botBrains doesn't enforce calling hours, so pick reasonable times yourself.

Repeated unwanted calls can break consumer law. The [Consumer Protection Law](https://www.cylaw.org/nomoi/enop/non-ind/2021_1_112/full.html), Annex I, Part B, point 3, lists persistent and unwanted solicitation by phone as an aggressive practice that's always unfair. On voicemail, the agent hangs up without leaving a message.

## Sector rules

| Sector | Rule |
| - | - |
| Consumer contracts by phone | Confirm your offer on paper or another durable medium. The consumer only becomes bound after signing it or sending written consent ([Art. 19(6)](https://www.cylaw.org/nomoi/enop/non-ind/2021_1_112/full.html)). An AI agent can't close a binding consumer contract on the call alone. |
| Financial services | Since June 19, 2026, the Consumer Protection Law covers distance financial services and requires the recording notice at the start of the call. Law 30(I)/2026 repealed the separate Law 242(I)/2004. |
| Political and charity calls | <Icon icon="signature" color="#d97706" /> Consent required. The Commissioner treats them as direct marketing, so the same consent rules apply. |
| Energy, telecoms, insurance | We found no extra telemarketing rules for these sectors. The general rules apply. |

## Fines and enforcement

| Regulator | Covers | Maximum |
| - | - | - |
| Commissioner for Personal Data Protection | Article 106 and the GDPR | EUR 200,000 per Article 106 breach ([Art. 107B](https://www.cylaw.org/nomoi/enop/non-ind/2004_1_112/full.html)), EUR 50,000 for obstructing an investigation (Art. 107A), and GDPR fines up to EUR 20 million or 4% of worldwide turnover |
| OCECPR, telecom regulator | The 2005 decree for companies | Orders to stop and administrative fines (Art. 107(1)) |
| Consumer Protection Service | Consumer law | 5% of annual turnover, or EUR 3 million where turnover is unknown (Art. 57(1)(ια) Consumer Protection Law) |
| Criminal courts | Unlawful recording | 10 years in prison, a EUR 100,000 fine, or both (Art. 3(1) Law 92(I)/1996) |

Anyone harmed by a breach of Article 106 can also sue in the civil courts (Art. 106(6)). The only published Cypriot fine for commercial calls we found is the EUR 3,250 Epic decision from 2023. After the May 2026 parliamentary elections, the Commissioner closed 24 complaints about unwanted political calls, SMS, and email with 3 warnings and 7 recommendations ([announcement](https://www.gov.cy/epitropoi/anakoinosi-tis-archis-prostasias-dedomenon-prosopikou-charaktira-gia-ta-apotelesmata-tis-exetasis-paraponon-pou-ypovlithikan-kata-tin-eklogiki-diadikasia-anadeixis-melon-tis-voulis-ton-antiprosopon-20/)). We found no Cypriot decision about AI voice agents.

## Sources

* [Law 112(I)/2004 on Electronic Communications and Postal Services, consolidated](https://www.cylaw.org/nomoi/enop/non-ind/2004_1_112/full.html), Art. 99, 102, 106, 107, 107A, and 107B
* [Legal Persons (Safeguarding of Legitimate Interests regarding Unsolicited Communications) Decree 2005, ΚΔΠ 34/2005](https://ocecpr.ee.cy/images/files_uploads/agora/nomothesia/diatagmata/EC_Order_LegalEntitiesUnsolicitedCommunications_GR_KDP-34-2005_28-01-2005_EK1.doc_0.doc), listed on the [OCECPR decrees page](https://ocecpr.ee.cy/nomothesia/ethniki-nomothesia/ilektronikes-epikoinonies/diatagmata?start=50)
* [Law 92(I)/1996 on the Privacy of Private Communication, consolidated](https://www.cylaw.org/nomoi/enop/non-ind/1996_1_92/full.html), Art. 2 and 3
* [Consumer Protection Law 112(I)/2021, consolidated](https://www.cylaw.org/nomoi/enop/non-ind/2021_1_112/full.html), Art. 19, 27A, 57, and Annex I
* [Law 30(I)/2026, which amends the Consumer Protection Law](https://www.cylaw.org/nomoi/arith/2026_1_030.pdf), Official Gazette of March 23, 2026
* Commissioner for Personal Data Protection: [direct marketing page](https://www.gov.cy/dataprotection/plirofories-gia-polites/apeytheias-emporiki-proothisi/), [Guidelines on direct marketing (August 2023, v1.1)](https://www.gov.cy/media/sites/67/2025/09/%CE%9F%CE%B4%CE%B7%CE%B3%CE%AF%CE%B5%CF%82-%CE%B3%CE%B9%CE%B1-%CE%B1%CF%80%CE%B5%CF%85%CE%B8%CE%B5%CE%AF%CE%B1%CF%82-%CE%B5%CE%BC%CF%80%CE%BF%CF%81%CE%B9%CE%BA%CE%AE-%CF%80%CF%81%CE%BF%CF%8E%CE%B8%CE%B7%CF%83%CE%B7-2023-v1.1.pdf), and [Guidelines on political communication (March 2024)](https://www.gov.cy/media/sites/67/2025/09/%CE%A0%CE%BF%CE%BB%CE%B9%CF%84%CE%B9%CE%BA%CE%AE-%CE%B5%CF%80%CE%B9%CE%BA%CE%BF%CE%B9%CE%BD%CF%89%CE%BD%CE%AF%CE%B1-%CF%80%CF%81%CE%BF%CF%8E%CE%B8%CE%B7%CF%83%CE%B7-%CF%85%CF%80%CE%BF%CF%88%CE%B7%CF%86%CE%B9%CE%BF%CF%84%CE%AE%CF%84%CF%89%CE%BD-2024.pdf)
* [GDPR (Regulation 2016/679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Art. 4, 6, 9, 13, 21, 28, and 83
* [ePrivacy Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2002/58/oj), Art. 13
* [EDPB Guidelines 05/2020 on consent](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en)
* [DLA Piper, Electronic marketing in Cyprus](https://www.dlapiperdataprotection.com/index.html?t=electronic-marketing\&c=CY)
* [Linklaters, Data Protected: Cyprus](https://www.linklaters.com/en/insights/data-protected/data-protected---cyprus), marketing by telephone
* [GDPR Enforcement Tracker, Epic Ltd (ETid-1818)](https://www.enforcementtracker.com/ETid-1818) and the [Commissioner's announcement on 2026 election complaints](https://www.gov.cy/epitropoi/anakoinosi-tis-archis-prostasias-dedomenon-prosopikou-charaktira-gia-ta-apotelesmata-tis-exetasis-paraponon-pou-ypovlithikan-kata-tin-eklogiki-diadikasia-anadeixis-melon-tis-voulis-ton-antiprosopon-20/)
* [Politis on the draft Artificial Intelligence Law of 2026](https://en.politis.com.cy/life/tech/1026739/cyprus-moves-to-implement-eu-ai-rulebook), August 2026

## Next steps

<Columns cols={2}>
  <Card title="Phone integration" icon="phone" href="/concepts/phone">
    Set up your phone line, introductions, and outbound calls.
  </Card>

  <Card title="Calling laws by country" icon="globe" href="/concepts/phone/countries">
    Compare consent rules for AI calls across the EU, the UK, and the US.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.