Most GDPR fines are about security failures or missing legal bases. A recent decision in Cyprus shows another risk: not cooperating properly with the supervisory authority.
1. EUR 6,000 Fine Over the Agora Platform
In September 2026 the Commissioner for Personal Data Protection, Maria Christofidou, announced a EUR 6,000 fine against the data controller of the Agora platform of the Direct Democracy app. According to the Commissioner:
- the controller's replies to repeated requests for information were "fragmentary, incomplete" and did not cover everything the authority had asked for;
- the platform was not temporarily suspended as the authority had requested; and
- these failures obstructed or delayed the investigation.
The controller has said he will challenge the fine in the administrative court, arguing that the decision does not concern a personal data breach.
2. Lessons: The Duty to Cooperate
Under Article 31 GDPR, controllers and processors must cooperate with the supervisory authority, and under Article 58 the authority can order them to provide information and to restrict processing. Failing to comply is itself an infringement — regardless of whether the underlying processing was lawful. In practice:
- answer requests from the Commissioner completely, clearly and on time;
- designate one person — ideally your DPO — to coordinate communication with the authority;
- keep your documentation (records of processing, DPIAs, policies) ready so you can respond quickly; and
- take orders seriously, and challenge them through legal channels rather than ignoring them.
3. EU Developments to Watch
- GDPR Procedural Regulation (EU) 2025/2518 applies from 2 April 2027 and sets common deadlines and rights in cross-border cases
- EDPB fining guidelines: adopted on 21 September 2026 and open for consultation until 13 November 2026, they explain when authorities should impose fines rather than other corrective measures
- Coordinated enforcement 2026: European authorities are checking transparency and information obligations (Articles 12–14 GDPR)
- Digital Omnibus: the proposed GDPR changes have stalled; the current rules still apply
Your Checklist
- Set up a process for handling regulator requests
- Keep your accountability documentation up to date
- Review your privacy notices for the transparency checks
- Appoint or review your DPO where required
How ResGuard Can Help
With the ResGuard Data Protection Manager your GDPR documentation is ready when the Commissioner asks. Our outsourced DPO service for Cyprus can act as your point of contact with the authority.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: announcement of the Cyprus Commissioner for Personal Data Protection as reported by Cypriot media, EDPB press releases and Regulation (EU) 2025/2518.