Last month Cyprus took an important step towards improving work-life balance and the protection of the personal data and privacy of employees.
More specifically, the Commissioner for Personal Data Protection issued on 26/05/2025, Directive No. 1/2025, on the use of personal mobile phones for work-related purposes, which is based on the Guidelines by the European Data Protection Supervisor, Opinion 2/2017 of the European Commission and the European Data Protection Board.
The Directive aims for more uniform and consistent guidelines on the use of personal mobile phones for the purpose of carrying out certain work-related tasks during working hours, in a manner that ensures the protection of the personal data and privacy of employees.
The key points of the Directive are the fact that employees are not obliged to use their personal mobile phone for work purposes, and that the use of a personal mobile phone for work purposes may be permissible when:
- the employee wishes to use their phone for such purposes;
- such use facilitates the performance of their duties; and
- it does not entail or involve the processing of the employee's personal data by their employer.
Furthermore, If the employee does not wish to use their personal mobile phone for work-related purposes, even when no data processing is taking place, the employer must:
- provide him/her with an alternative solution; and
- ensure that the employee is not subject to adverse consequences if he/she chooses this alternative solution. Such alternative solutions may include the provision of a company device or sponsoring for the purchase of such device, as well as reimbursement for usage costs, where applicable.
In cases where the employee's duties require the use of a personal mobile phone on a systematic basis, whether or not their data is being processed, the employer must establish a policy and inform the employees of the same, which policy should among other things, regulate what happens in the event that:
- the employee forgets the device at home;
- the device breaks down or malfunctions;
- the employee no longer wishes to use the device for work-related purposes.
In any case, the employer should be able to adequately and appropriately substantiate the absence of data processing (i.e. for example when the use of a mobile phone is required for not strictly work-related tasks, such as for the accessing of documents and receiving a one-time password (OTP), as well as complying with the principles of data processing under GDPR law.
The Commissioner has noted that further long-awaited directives will follow related to teleworking, both for the public and the private sector.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
