The Statistical Service (CYSTAT) irrevocably observes the provisions of the Official Statistics Law of 2021 (the Law) regarding the protection of confidential data, as these are defined under article 16 of the Law. More specifically, CYSTAT implements, among others, the following measures:

• Confidential data obtained exclusively for the production of official statistics, are used by CYSTAT exclusively for statistical purposes. The use of confidential data for any other purposes beyond the statistical ones is prohibited (e.g. administrative, legal or tax purposes and the verification against the statistical units).

• CYSTAT takes all necessary regulatory, administrative, technical and organisational measures to ensure the physical and logical protection of confidential data (statistical disclosure control) used for official statistics.

• Official statistics compiled by CYSTAT on the basis of data resulting from a survey or from other sources are published in such a manner as to render impossible the direct or indirect disclosure of the identity of the persons who provided the data or the statistical units to which the data relate.

• The officials of CYSTAT, take a confirmation on oath, that they shall not disclose information which comes to their knowledge during the performance of their tasks, while the obligation of keeping statistical confidentiality continues to exist even after the termination of their functions or of their contract.

• The data collected or obtained during the carrying out of a survey or other work continues to be considered as confidential, irrespective of whether the statistical results of the survey or other work have been published.

• CYSTAT takes appropriate measures in order to prevent and penalise any violations of statistical confidentiality.

• The Official Statistics Law of 2021 includes provisions relating to penalties for the protection of confidential data (Article 19 - Offences and penalties).

Specifically regarding the protection of personal data, CYSTAT applies the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR), as well as the Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data of 2018 (Law 125(I)/2018). According to article 6(1)(c) of the GDPR, CYSTAT has the right to collect and process personal data since processing is necessary for compliance with a legal obligation to which the controller is subject. The basis for the processing is laid down by a) Union law, meaning the current legal acts of the EU according to which the various surveys are conducted and statistics are produced or b) Member State law to which the controller is subject, meaning the Official Statistics Law of 2021 in the framework of which the activities of CYSTAT are carried out. In compliance with the provisions of the GDPR, CYSTAT has appointed a Data Protection Officer, whom citizens can contact regarding any issue concerning their personal data processed by CYSTAT as a "controller".

It should be noted that, any data obtained from sources lawfully available to the public and which remain available to the public, do not require protection and therefore, CYSTAT may publish a name list of limited liability companies, public corporations and local government authorities, which includes information relating to their address, their economic activity and any other lawfully publicly available data.