Is it legal to record a meeting in Cyprus?

Ν. 92(Ι)/1996, the Protection of the Confidentiality of Private Communications Law, as amended, implementing Article 17 of the Constitution. Article 3(1)(a): every person who intentionally intercepts or monitors or in any way obtains access to the content of any private communication is guilty of an offence and liable to imprisonment not exceeding ten years or a fine not exceeding €100,000, or both. Subparagraphs (b) to (d) add using a device for that purpose, disclosing the content, and using it.

Two definitions in article 2 do the work, and both are broad.

Παρακολούθηση, monitoring, means the acoustic or other capture of the content of any private communication using any electronic, mechanical, electromagnetic, acoustic or other device, and expressly includes listening, tape-recording or any other form of recording. So a transcriber is squarely within monitoring.

Ιδιωτική επικοινωνία, private communication, means any oral or written or other form of communication, or any telecommunication or electronic communication, made in circumstances in which it is reasonable for the person to expect that it will not be intercepted or monitored by any other person other than the one intended to receive it. So an in-person meeting is covered, not only a phone call.

The framing is eavesdropping on communications, drafted around the act rather than around whose words they are. That is exactly why the participant question is unsettled here.

Genuinely unclear, and we are publishing it as unclear. The statute does not answer it either way, and two readings are available on the text.

Reading A, the participant is caught. The exception in article 3(2)(a) disapplies the offence for a person who has "προηγούμενη ρητή έγκριση", prior express approval, from the person who makes the communication and from the person who received or is intended to receive it, "or from one of the two in the case of obscene, harassing or threatening anonymous telephone calls". That is an all-party express-approval regime, and the one-party carve-out for harassing calls is the strongest textual argument that a participant is otherwise caught: the carve-out exists precisely so the recipient of a harassing call may record with only their own approval, which would be unnecessary if a recipient never needed the other party's approval in the first place.

Reading B, the participant is outside the offence. The reasonable-expectation element in the definition of private communication is measured against monitoring by a person "other than the one intended to receive that communication". As against the intended recipient, the speaker has no protected expectation of non-monitoring, so vis-à-vis that recipient there is arguably no private communication to intercept. That is the same structural argument that keeps a participant outside ePrivacy Art. 5(1) and outside Malta's reg. 4(1).

No Cypriot case law was opened and no authority resolves it. Given a ten-year maximum and a €100,000 fine, the conservative reading is the operating assumption, and anyone telling you a participant may record in Cyprus is telling you something nobody knows.

On the conservative reading: προηγούμενη ρητή έγκριση, prior express approval, from every other party. The statute's words are prior and express, so an announcement is not enough on that reading, implied consent from continuing to speak is not enough, and a calendar-invite line is certainly not enough.

Use the long form, ask, and get an audible answer from each person before the substance starts.

Before we start: I record my meetings so I can write up notes afterwards. It runs on my laptop, the audio is transcribed on this machine and never uploaded, and the audio itself is not saved anywhere, only the text, in a file I keep. Is everyone alright with that? If anyone would rather I didn't, say so now and I'll turn it off.

No authority was found on the form that approval must take.

GDPR applies as well, and the analysis is the ordinary European one: a meeting recording is personal data about every identifiable speaker, a transcript without speaker labels is still personal data, the household exemption is read narrowly and a work meeting has a direct connection to a professional activity, you need a lawful basis, and Art. 13 wants the information at the time the data are obtained, which for an always-on recorder means before the substance of the meeting. The European framework covers all of that once rather than on every country page.

No statutory works council and therefore no co-determination trigger. Cyprus runs employee representation through recognised trade unions and collective agreements rather than a statutory council. We state that only as an absence.

No provision restricting audio monitoring specifically was found beyond Ν. 92(Ι)/1996 itself, which is not framed around employment at all. Note that the Law's exceptions are almost entirely about judicially authorised interception and about prisons and providers: there is no employer exception.

The practical consequence is that in Cyprus the employer layer is second-order, as in Greece: if the conservative reading of article 3 is right, the individual is already exposed and no amount of workplace process fixes it.

The Commissioner for Personal Data Protection. Nothing found on meeting recording or on the interaction between Ν. 92(Ι)/1996 and the GDPR, and no guidance document was opened.

This is the gap most worth closing in the whole European half of this reference, because a Commissioner's view on whether a participant's own recording is παρακολούθηση would probably settle the practical question.

Start with what does not help, because it is what our own positioning tempts us into claiming. Earkeep transcribes on your own device, never writes the audio to disk and sends nothing anywhere. On the criminal layer in Cyprus that changes nothing at all. A recording made without the other speakers' consent is the same act whether it was processed on your laptop or uploaded to somebody's cloud, because the provision is about making the recording rather than about where it ends up.

Where the architecture genuinely helps is data protection: no transfer, no third party in the chain, no processor agreement to sign, and nothing to reconcile if someone asks you to delete what was said. And in the conversation itself, "it stays on my laptop and the audio is never saved" is a shorter thing to explain than what a cloud notetaker requires, which makes the agreement easier to actually obtain.

Earkeep announces itself to nobody. There is no bot in the participant list and no banner on anyone else's screen, so where the announcement is what makes the recording lawful, the whole of it depends on you saying something. What the app gives you is somewhere to go when the answer is no: a pause from the live edge that releases the microphone and the system audio stream, so the operating system's own recording indicator visibly goes dark; a never-record marking for a meeting on a connected calendar; and a purge that takes the lines out of the file on your own disk with no server copy anywhere. It does not make any recording lawful, and no tool can.

• Ν. 92(Ι)/1996, consolidated text on CyLaw
• Commissioner for Personal Data Protection
• GDPR, EUR-Lex

• European recording laws: the four layers, the controller question, and all 32 countries.
• Telling people you're recording: the scripts, and the three ways to stop.
• Private by design: why the audio never leaves your computer.

This page is legal information, not legal advice. It summarises provisions and guidance rather than replacing them, and we are not lawyers. If the answer matters, ask someone who can be held to their answer.