High-Risk AI System
An AI system whose use poses a significant risk to health, safety or fundamental rights — including systems used in recruitment, credit scoring, education and access to essential services (Article 6 and Annexes I and III, EU AI Act).
Internet of Things (IoT) Data
Personal data collected by internet-connected devices — smart speakers, wearables, connected cars — which still falls fully under GDPR’s data minimisation and security requirements, even when it is collected passively in the background (Articles 5(1)(c), 32).
NIS2 Directive
An EU cybersecurity law requiring a wider range of medium and large organisations in essential and important sectors to manage cyber risk and report significant incidents, sitting alongside — not replacing — GDPR’s own breach notification duties. Cyprus transposed it through Law 60(I)/2025, in force since 25 April 2025 (Directive (EU) 2022/2555).
Prohibited AI Practices
Uses of AI banned outright in the EU, including social scoring, inferring emotions in the workplace or in education, biometric categorisation to infer protected characteristics, and untargeted scraping of facial images (Article 5, EU AI Act).
Provider (AI Act)
The organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3), EU AI Act).
Web Scraping & AI Training Data
The automated collection of publicly posted personal data, often to train AI models. The EDPB has confirmed this is still processing under GDPR and needs a valid lawful basis — publicly available does not mean fair game (EDPB Opinion 28/2024).