Cyprus software delivery: GDPR, accessibility, Peppol and bilingual acceptance

OutsourcingVN is operated by Netbase JSC, so this guide is written by a supplier that would like your project. It sets out what Netbase can evidence for a Cyprus brief, points to the official references your own advisers should read in full, and names the decisions that stay with you. The guides index lists guides for other markets, and the market index compares the first question each one raises.

Contents

• Who enforces data protection for a Cyprus-facing product?
• What can Netbase evidence for a Cyprus brief?
• Which requirement sits with which decision owner?
• Which steps come before a Cyprus-facing launch?
• Worked scenario: a Cypriot public body asks for a Peppol invoice
• What has Netbase built that is relevant to a Cyprus brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

Who enforces data protection for a Cyprus-facing product?

GDPR applies across the European Union, and Cyprus reaches it through its own national authority, the Commissioner for Personal Data Protection, rather than a separate Cypriot law layered on top. A controller must have a lawful basis for each use of personal data, honour access, correction, erasure and portability requests, and tell its supervisory authority of a qualifying breach within 72 hours of becoming aware of it. Fines can reach the higher of €20 million or 4% of global annual turnover.

None of that changes because the development team sits outside Cyprus. What changes is who signs the processing agreement, who is named as controller or processor, and who answers the Commissioner's questions if a Cypriot user complains. A buyer should decide those three roles before discovery starts, not after a defect is found.

What can Netbase evidence for a Cyprus brief?

Procurement, security and data protection reviewers tend to ask for the same three statements. These are the ones Netbase can give.

• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. Deciding how GDPR applies to your own product and who your Cyprus data protection contact is remains your organisation's task.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement for a Cyprus-facing system sits on top of this baseline.
• Markets and language. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Delivery communication is in English, so Greek copy for a Cyprus-facing product is scoped as a project task, with a named Greek copy owner who also signs off the English version used in business tools.

Which requirement sits with which decision owner?

Five separate decision owners usually appear somewhere in a Cyprus brief, each with a requirement, a piece of evidence and a name attached to it; keeping those three apart stops a proposal from promising more than one team can actually check.

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Worked scenario: a Cypriot public body asks for a Peppol invoice

A software vendor wins a contract to supply a public-sector body in Cyprus and is asked, mid-project, to send its invoices electronically.

A proposal that cannot describe step 3, specifically which access point or gateway carries the invoice, has not yet scoped Peppol for this contract.

What has Netbase built that is relevant to a Cyprus brief?

Geo-Tek IT Solutions, an IT company in Cyprus, bought the Netbase online design tool and had the Printshop template installed by the Netbase delivery team, giving Geo-Tek's customers both an artwork-upload route and an upload-and-design route on the same catalogue. Geo-Tek reported engagement up 35%; the source records no period for that figure. The Geo-Tek IT Solutions store launch record has the full detail and its limitations, and the same kind of online design tool sits behind the broader web-to-print platforms solution.

Which questions should you ask a supplier?

• Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract, not during a breach.
• What exactly does your security and compliance statement cover? A precise answer says what it does not cover as well as what it does.
• Can you show a Peppol invoice export from a past project? Ask for the structure, not just a claim that it exists.
• Who tests the Greek-language journeys, and who approves the copy? A good answer names an owner and a review step before release.
• Where does the engineering team actually sit, and what is the escalation path? A precise answer names working hours and a named contact, not just a time zone.
• Who decides if an accessibility defect blocks release? It should be your product or service owner, not the supplier.

What usually goes wrong?

• A company-level compliance statement presented as proof for this product. Signal: nobody has actually tested the product's own data flows or access rules. Owner: the data protection lead.
• Accessibility testing scheduled only after the design is locked. Signal: changes that affect layout or navigation are proposed days before release, when they are expensive to make. Owner: the product owner, who should test each journey during the build.
• A Peppol export built against documentation alone and never tried against a real access point. Signal: the first live invoice fails validation after go-live. Owner: the finance systems owner, who should rehearse the export before the contract starts.
• Greek copy added as an afterthought to an English-first interface. Signal: truncated labels and broken layout once real Greek text replaces placeholder strings. Owner: the localisation owner, who should test with real copy from the first build increment.

How this guide is sourced and where it stops

This guide draws on the European Commission's AccessibleEU Centre page on Cyprus's public-sector accessibility law, the European Commission's eInvoicing country sheet for Cyprus, and the European Commission's Your Europe business page on GDPR, all checked on 2026-10-13, together with a delivery record approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Cyprus-facing brief. It does not decide which accessibility standard or data protection role fits your organisation; your own advisers make that call.

Plan the first release

Bring your data protection role split, your accessibility standard, your Peppol posture and your Greek-language scope. The data security and compliance guide lists the contract questions behind the data protection row. For neighbouring and nearby markets, the UK guide covers UK-specific accessibility duties for a market outside the EU, the UAE guide covers a different bilingual pattern around Arabic and English, and the Sweden guide covers the same EU law base with a different national identity and payment pattern.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Cyprus-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions