Personal Data is any information that relates to an identified or identifiable living natural person.

Controller is any natural or legal person, public authority, service or other entity which, alone or jointly with others, determines the means and purpose of the processing of personal data.

Data subject is the natural person to whom the data refers and whose identity is known or can be verified, directly or indirectly, based on one or more concrete information.

Processing is any action or series of actions performed on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, data search, use, disclosure, transmission, dissemination, disposition, alignment, combination, restriction, deletion or destruction of personal data.

On 25 May 2018, the European Regulation (EU) 2016/679 of the 27^th April 2016 entered into force, concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), (hereinafter the European Regulation).

The European Regulation stipulates a special framework and a set of regulations concerning the protection of natural persons, within the European Union (EU), regarding the processing of personal data.

The present Data Protection Policy of the Department of Lands and Surveys (hereinafter DLS) concerns the Data Protection processing by the DLS.

The DLS faithfully implements the provisions of the national legislation in force, as amended from time to time, as well as the provisions of the European Regulation.

The DLS collects, processes and uses personal data during the submission of an application/statement. It commits to protect the confidentiality of personal data and to handle it in an open and transparent manner.

The compliance with the present policy applies to all the staff of the DLS and the DLS ensures that the staff complies with the present policy.

The acronym DLS refers to the Department of Lands and Surveys, which pertains to the Ministry of Interior of the Republic of Cyprus and includes its Headquarters, all of the District Land Offices and their sub-offices, the Branches, as well as any other Service of the Department.

The DLS, as the competent department for handling many different issues, including tenure, registration and valuation, transfer, mortgage and encumbrance of immovable property, cartography, surveying, geodesy, hydrography and photogrammetrical surveying, keeps records with personal data, such as:

(1) Records of land information

(2) The record of general prohibitions and encumbrances

(3) The record of alien owners of immovable property

(4) The record of power of attorneys

The records concern the owners of immovable property, persons with rights on immovable property, mortgage creditors and debtors, natural persons subject to prohibition, foreigners who acquired immovable property in any way, principals and their representatives.

The DLS processes personal data of natural persons, such as owners of immovable property, holders of property encumbrances, holders of other property rights, debtors, applicants, principals and representatives, natural persons subject to prohibition, recruitment candidates and DLS staff.

The processing of personal data based on the present policy does not concern legal persons, such as companies, organisations, unions, institutions, government services and other legal entities, but nevertheless concerns natural persons acting on behalf of legal persons.

Owners of immovable property: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Holders of property encumbrances: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Holders of other property rights: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Debtors: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Applicants: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Representatives: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Natural persons subject to prohibition: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, date of birth, postal address, landline and mobile number, personal status.

Recruitment candidates: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, social insurance number, date of birth, landline and mobile number, postal address, personal status, qualification details, copies of academic or educational degrees and professional qualifications, license to practice.

DLS staff: full name, maiden name, spouse’s name, identity card number and/or passport number and/or foreign citizen number, social insurance number, date of birth, landline and mobile number, postal address, personal status, copies of academic degrees and professional qualifications. 

The DLS ensures to legally collect personal data for the purposes of performing its duties, in the following ways:

• By the persons themselves, who willingly provide the data by submitting the application or statement to register or transfer or mortgage a property or during the examination of various cases.
• By third persons, such as co-owners, creditors, debtors, representatives, principles or other persons connected in any way with the data subjects.
• By a competent body that sends the personal data.
• Through a letter or an application in writing.
• Through electronic media.

The DLS is required to ensure that the personal data goes under legal, confidential and classified processing, pursuant to the European Regulation.

The DLS processes the personal data in the extent that the processing is necessary:

–     data subjects have given consent for the processing of their personal data for one or more specific reasons,

–     the processing is necessary for the execution of the contract whose contracting party is the data subject or for the adoption of measures following the data subject’s request prior to the contract conclusion,

–     the processing is necessary for compliance reasons, resulting from the legal obligation of the controller,

–     the processing is necessary for the duty fulfilment, executed for the public interest or during the exercise of public authority assigned to the controller,

–     the processing is necessary for the purposes of legitimate interest sought by the controller or a third party, unless the interest or the fundamental rights and freedoms of the data subject imposing the protection of the personal data prevails against this interest, especially if the data subject is a child (minor).

The collection and processing of the personal data is made based on article 6, paragraph 1, points (a), (b), (c), (e) and (f) of the European Regulation.

For the examination of an application/statement or any action, personal data is required to be provided to the DLS in the extent that this is necessary for the evaluation of the application/statement/action. Any objection to provide or to process the users’ personal data will block the examination of the application/statement/action.

The DLS processes and stores personal data in physical and digital files and is not deleted after a specific period of time. The retention and processing of personal data is permanent.

The personal data regarding children is collected only under the condition that the DLS has received the consent of their parents or legal guardian, there is a court order or if it is required by law. The DLS does not provide services to children directly, but nevertheless it may collect children’s personal data in the framework of its main activity, for the purposes of transfer acts/inheritance applications. For the purposes of the present statement of personal data protection policy, “children” are individuals under the age of eighteen (18) years.

The processing of personal data is carried out solely and exclusively for the purposes for which it is submitted.

The DLS, under no circumstance sells, leases, grants or in any other way sends to third parties any personal data submitted to its services. An exception to that would be when data disclosure is required by an explicit provision of the law and it is done exclusively to the competent authorities.

Personal data may also be disclosed following the procedure provided by the European Regulation, the national legislation in force and article 51A of the Immovable Property (Tenure, Registration and Valuation) Law (Cap. 224) to other services of the Republic of Cyprus or to public organisations and/or individuals and/or banks who, based on the provisions of the legislation in force, have the right to receive information concerning immovable property, which is entered in the registry or any other archive of the Department of Lands and Surveys, such as the Inland Revenue Department, the Department of Social Welfare Services, City and Community Councils, Sewage Boards, the Water Development Department concerning governmental water works, acquiring authorities for the purposes of implementing the Compulsory Acquisition of Property Law, owners of bordering properties, co-owners of properties, future heirs, prospective buyers, judgment creditors, property valuers in cases regarding compulsory acquisition, Water Commissioners based to the legislation in force and to any other person who the Director of the DLS deems to be entitled to the provision of information.

In such a case, these services shall commit in writing that the personal data shall be subject to the same degree of protection, confidentiality and classification as by the Department of Lands and Surveys.

Banks are required to inform immediately and in writing about the persons for whom they asked information concerning their immovable property, stating the reasons for their query.

Normally, the DLS does not transmit personal data to third countries or international organisations, unless there is a special or international convention allowing it, provided that the consent of the data subject has been obtained.

The DLS takes the necessary technical and organisational measures, so that personal data is processed in such a way that its appropriate security is ensured, as well as its protection against unauthorised or illegal processing and accidental loss, destruction or damage.

The DLS has procedures to address any suspicious data breach. In that case, the DLS, which is legally bound, shall notify the person and any competent regulatory body.

According to the European Regulation, the data subject has some significant rights:

• The right of information (Article12): The data subject has the right to receive any information regarding the processing in a concise, transparent, intelligible and easily accessible form, as well as a reply within one month of receipt of the request. This information is provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the DLS may either:

1. a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
2. b) refuse to act on the request

• The right of information (Articles 13 & 14): The DLS informs the data subject about the purposes of the processing for which the personal data is intended, the subject’s rights, the legal base for the processing, the recipients, as well as the processing period.
• The right of access (Article 15): Data subjects have the right to receive a copy of their data under processing, as well as information about the purposes of the processing, the categories of personal data concerned, the period of its storage, as well as the recipients to whom it has been disclosed.
• The right to rectification (Article 16): Data subjects have the right to request a rectification/completion of inaccurate personal data and their request shall be fulfilled without unreasonable delay.
• The right to erasure (Article 17): Data subjects have the right to request from the controller the erasure of personal data concerning them without undue delay, unless the legitimate interest of the controller prevails.
• The right of notification (Article 19): The controller communicates any rectification or erasure of personal data or restriction of processing of the data to every recipient to whom the personal data was disclosed and informs the data subject accordingly.
• The right to object (Article 21): Data subjects shall have the right to object to the personal data processing concerning them, unless the legitimate interest of the controller prevails.

Data subjects have the right to withdraw their consent statement at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In case that the DLS, as the data controller, has the legitimate interest to retain the personal data concerning them, their request of withdrawal and/or erasure may not be granted.

Data Subjects have the right to lodge a complaint to the Commissioner of Personal Data Protection, in case they have any disagreement regarding the use of their personal data (You can find more information at http://www.dataprotection.gov.cy).

Based on the European Regulation, the DLS has assigned a data controller, who participates, duly and promptly, in all matters concerning personal data protection.

Data subjects can contact the DLS data controller regarding any matter concerning the processing of their data, either by post to the address: Department of Lands and Surveys, 10 Iasonos str., 1082 Nicosia, at 22804913, or by email at celiseou@dls.moi.gov.cy.

The DLS has the right to amend the present Data Protection Policy when deemed necessary. In case of any amendments, information will be provided on our website.