Recruit
Cyprus applies the GDPR to recruitment screening, with an additional statutory requirement for anyone working with children. Employers should treat criminal record checks as the exception rather than a standard step.
Criminal record checks
The candidate applies to the Cyprus Police for a criminal record certificate and provides it to the employer. Employers cannot search police records themselves. A separate certificate confirming the absence of convictions for offences against children is required by law for anyone whose work brings them into contact with minors, covering schools, childcare, sports coaching, and similar roles. Outside those roles and other regulated sectors such as banking, private security, and healthcare, requiring a certificate needs a specific justification.
What employers can check
Identity, right to work, employment history, and academic qualifications are all legitimate. Degrees can be verified with the issuing institution, and qualifications from outside the EU generally need recognition before they can be relied on for regulated professions. Right to work checks matter given the mix of EU and third country nationals in the labour market.
Data protection
The GDPR applies alongside Cypriot implementing law, supervised by the Office of the Commissioner for Personal Data Protection. Criminal conviction data attracts additional protection and cannot be processed simply because a candidate agrees to it. Consent is a weak basis in the employment context, so rely on a legal obligation or on necessity for the role, be transparent, collect the minimum, and delete unsuccessful applicants’ data once recruitment closes.
Practical guidance
Identify which roles legally require a certificate and which merely benefit from one, and document the reasoning. View rather than retain certificates where you can. An employer of record can manage screening if you have no Cypriot entity.
