Administrative & public law litigation
Administrative recourse before the Administrative Court of Cyprus
I act for businesses and individuals challenging the decisions, acts, and omissions of public authorities under Article 146 of the Constitution. Most recourses are lost on admissibility, long before a judge ever looks at the merits. That is where my work begins.
The recourse is usually won before the merits
A frustrating number of recourses fail at the admissibility stage. Wrong act challenged, the deadline miscounted, standing surrendered by a careless payment, relief drafted so loosely that the court cannot tell what is under attack. None of these reach the question of whether the administration acted lawfully. They are decided, and lost, on procedure.
I treat admissibility as the first battle, not an afterthought. Get the act, the clock, the standing, and the relief right, and a recourse with substance has a real chance to be heard. Get them wrong, and the strongest argument on the merits never gets read.
Where these cases turn
Six points that separate a recourse that is heard from one that is struck out
The 75-day clock, and who controls it
The period runs from when the client acquired knowledge of the act, which is not always the date printed on the letter.
- A posted notice carries a rebuttable presumption of delivery
- If a recourse looks late on its face, the burden shifts to the applicant to prove when knowledge was acquired
- A timely written reminder to a silent authority can fix the record and protect the date
The executory act, not the polite refusal
A recourse lies only against an executory administrative act. Choosing the wrong target is a common and fatal error.
- A later "we maintain our position" letter is usually confirmatory and gives no fresh right of challenge
- An interim step that has merged into the final decision loses its own executory character
- Identifying the right act is the difference between a hearing and a dismissal
Objection, or straight to court
An objection or hierarchical recourse is sometimes a precondition to a valid recourse and sometimes a tactical choice worth taking.
- Used well, it can open a reconsideration on the merits, not only on legality
- It can put evidence and expert material into the administrative file the court later reviews
- Filed alongside a court recourse, by contrast, it can render the recourse premature and inadmissible
Keeping your standing intact
A legitimate interest can be lost by conduct. The danger is quiet acceptance of the very decision you mean to fight.
- Paying an assessed tax or fee without an express reservation of rights may read as acceptance
- Complying with the contested decision can be treated the same way
- I plan compliance under protest so a demand can be met without surrendering the recourse
Pleading the relief with precision
The relief sought must name the impugned act clearly. The 75-day window usually bars fixing it later by amendment.
- The court's jurisdiction is annulment, not a civil-style award of damages
- Remedies that belong to the civil courts have no place in the pleading and invite dismissal
- Grounds of annulment belong in the legal points, not in the prayer for relief
Stopping irreparable harm early
Filing a recourse does not, on its own, suspend the decision under challenge. The harm can crystallise while the case is pending.
- Where a licence is revoked or a demand bites at once, an interim suspension must be prepared in parallel
- The application has to meet its own test, on its own evidence
- Prepared with the main recourse, it protects the client's position from day one
The disputes I take on
Public-law challenges where a state decision affects a business or an individual directly
How I have argued these cases
Two recourses, told without naming anyone, to show where I look for the winning point
A regional construction company, a small and medium-sized enterprise, lost a multi-million tender run by a public utility. The work had been split into geographic lots, with a priority rule that capped each bidder to two areas. The obvious move was to argue price and scoring. I argued the split itself. Article 59 of the public-procurement law, read with the EU directives behind it, allows a contract to be divided by size and by object, and it exists for one declared reason: to open public contracts to smaller firms. Carving the work along a map, rather than by size or object, struck me as a misreading of the law that defeated its own purpose, and I supported that reading with an OECD study on the division of contracts into lots and with European case law.
The sharpest material came from the authority's own board minutes. Its members had worried aloud that multi-million tenders kept drawing only two or three bidders. I turned that internal record against the decision: the division had produced the opposite of what the law intended, and the priority rule had cost the authority itself a six-figure sum it could have saved. The case was built on the structure of the tender, not on a complaint about the marks.
A long-settled foreign national, married to a Cypriot for years, with property here and an unbroken lawful residence the State had itself documented through one permit after another, had a naturalisation application refused on a single ground: an alleged irregular entry years earlier. The instinct is to relitigate that entry. I went after the decision-making instead. The Minister held a discretion to set exactly that kind of historic point aside; treating it as decisive looked like a discretion that was never actually exercised, a free power handled as if it were bound.
From there the argument was about how the refusal was reached, as much as its result. The application had been judged on immigration criteria when the real question was integration and citizenship, which pointed to an extraneous purpose. The decision came without due inquiry and without ever hearing the applicant. A State that had regularised his stay for years could not act as though those years had not happened, which engaged good faith and consistency, and the refusal reached into private and family life under the Convention.
Common questions on administrative recourse in Cyprus
Short answers to the questions clients ask first
What kinds of decisions can be challenged before the Administrative Court in Cyprus?
Who can file an administrative recourse in Cyprus?
What is the deadline for filing an administrative recourse in Cyprus?
What happens if the court annuls an administrative act?
Can I claim damages for an unlawful administrative act in Cyprus?
Do I need a lawyer for an administrative recourse in Cyprus?
How I build a recourse
The court reviews legality and is confined to the administrative file. So I work backwards from that file and from the grounds of annulment, with the deadline and the admissibility points settled first. I come to this from a commercial background, having run a business before the law, which means I read a regulator's decision for what it does to your operation, not only for how it reads on paper.
Hi, I’m Panayotis Yannakas
your
Lawyer.
Litigator.
Business Consultant.
Attorney.
With a total of 5 years of professional experience navigating the Cyprus legal regime, I am a licensed Litigation Lawyer with comprehensive experience managing complex court cases, providing expert legal advice, and drafting contracts and legal documents. At my office, I am dedicated to providing personalized solutions that are tailored to your unique needs. My legal expertise has been strengthened by working on the legal research team of Cyprus Central Bank, and I have served as a trusted legal counsel for clients across various legal firms
Professional Insights
General Lawyer: Why I Practice Law without a Specialty Label
Clients ask it reflexively: “What do you specialise in?” The question sounds like due diligence, but it rests on a false premise. It assumes that legal problems arrive wearing the correct jurisdictional badge and stay within their lane. They do not. They never have. Yet the legal market has spent decades encouraging this belief, rewarding lawyers who carve themselves into ever-narrower slices and market depth at the expense of breadth.
I am a Litigation and General Practice Lawyer in Cyprus, and I introduce myself as such deliberately. In a profession where “specialist lawyer” is a title anyone can claim and no institution will verify, the generalist who sees a legal matter whole offers something the narrow practitioner structurally cannot: peripheral vision.
The Unverified Label
A specialist physician earns a credential the state validates and the profession enforces. The”specialist lawyer“, in most jurisdictions and certainly in Cyprus, has simply decided to describe himself that way. The Cyprus Bar Association recognises no formal specialisation system. The ABA’s own rules protect the word certified; the title specialist remains open to anyone willing to print it on a business card.
Legal services are what economists call credence goods: quality is opaque before, during, and after the engagement. When clients cannot verify expertise, an unverified specialty title acquires persuasive force far beyond its informational content. The generalist who is transparent about his breadth offers something more honest: a clear picture of how he practises, rather than a label no regulator has endorsed.
The Blind Spots of Narrow Practice
Professor Moorhead’s research on cognitive narrowness found that specialist lawyers referred out-of-specialty problems at roughly half the rate of generalists and were more likely to tell a client that no course of action existed, even where the true limitation was the lawyer’s own focus rather than the merits. The specialist, in other words, does not always know what he is missing.
Real legal situations arrive in clusters. A redundancy becomes an employment claim, a tortious dispute, and, where the employer enjoys diplomatic status, a question of sovereign immunity. A commercial contract can conceal a fraudulent misrepresentation, an insolvency risk, and a criminal exposure. The generalist treats the legal landscape as a terrain: uneven, interconnected, and requiring constant peripheral vision.
Why Breadth Wins
David Epstein’s distinction between “kind” and “wicked” learning environments applies directly to law. Chess rewards repetition; litigation does not. The facts never repeat themselves exactly, and the intersections between regulatory regimes, contractual obligations, and human behaviour are never quite the same twice. Breadth of experience is itself the primary mechanism by which sound judgement is formed.
A study in Nature Computational Science examined over sixty thousand federal civil proceedings and found near-zero correlation between prestige rankings and actual litigation outcomes. Courts are staffed by generalists, and lawyers who have spent a career in a single regulatory corridor can find, at the moment of argument, that they are speaking fluently in the wrong language. The generalist speaks the court’s own language; the specialist often has to translate.
Adding an investigative partner to my practice
My office has entered into a formal cooperation with Bakun Group Ltd, and with its intelligence and investigations division, Bakun Intelligence. The purpose is to bring investigative work and legal work together under one roof, openly, and to a standard a court will accept.
In Cyprus that is an unusual thing to state plainly. Where investigation and law meet here, they tend to meet informally, and quietly. I have decided to make it a declared part of how the practice works, because a client is better served when the question of fact and the question of law are handled together from the start, by the same person who will later draft the agreement or argue the case.
A declared capability, not a back channel
An investigator can be engaged by anyone. What is rare is a practice that names that capability, builds it into its instructions, and stands behind the result in its own legal work. A client who needs a person found, an asset traced, or a counterparty checked usually has to commission the work elsewhere and then hope the output can be used. Here the investigative question is framed alongside the legal one and answered to the same standard, which in this market is close to unique.
It also says something about the office itself. The work is no longer confined to the courtroom and the contract. It now reaches the facts that decide whether a case is worth bringing and whether an agreement is safe to sign.
How a matter runs
Every engagement follows the same discipline, whatever the subject.
Finding the answer is only part of the work. The answer has to be obtained in a way that protects the matter and the people inside it.
The partner
Bakun Intelligence, the intelligence and investigations division of Bakun Group Ltd, a Cyprus company working across Europe, the Middle East, Africa and Asia.
For the matters I take on with it, the division traces people and assets lawfully and records how each search was carried out, drawing on open sources and trusted contacts across jurisdictions. Its work sits close to the legal questions it supports:
- Counterparty and background intelligence
- Asset tracing and exposure mapping across jurisdictions
- Discreet enquiries and on-the-ground verification
- Geopolitical and operational risk assessment
In one enforcement matter the office located a debtor's interests held behind a chain of intermediary companies. In another, it carried out discreet international verification on a counterparty before a client committed to a transaction. In every matter the office works to my instruction and under my supervision, so the result reaches the court in a form it will accept.
Matters are described in general terms. Past work is not a guarantee of any future result.
The wider group
Intelligence is one division of several. Beyond it, Bakun Group Ltd advises on security and risk, on investment in premium real estate, yachting and private aviation, and on hospitality and lifestyle projects. The cooperation here belongs to the intelligence division, but the rest gives a fair sense of the company behind it: international, discreet, and accustomed to private clients who value judgement over noise.
Security advisory, risk assessment, and protection planning for individuals, corporations and institutions.
Advisory across premium real estate, yachting and private aviation, structured around the client's interest.
Hospitality and lifestyle concepts, from private retreats to boutique destinations.
Headquartered in Cyprus, the company works across Europe, the Middle East, Africa and Asia, with a presence in:
The three lines of work
Three areas come up most often. Each has a page of its own, with the law and the procedure set out in full.
Tracing missing persons
Locating a person whose whereabouts are unknown, to a standard the proceedings can rely on. Absence is a ground for divorce, and it bears on succession, the service of documents, and other family and civil matters.
View the page →Asset and property tracing
Identifying assets and the people who control them, including holdings placed behind companies and across borders, to support recovery, freezing and enforcement.
View the page →Due diligence
Checking a counterparty, a target company, or a transaction before anything is signed, so the agreement rests on verified facts rather than on what the other side chose to disclose.
View the page →
This Year’s DataGuidance Contribution: Data Breach Notifications in Cyprus
Updated DataGuidance analysis on Cyprus data breach notifications: GDPR-NIS2-DORA convergence, Article 12 of Law 125(I)/2018, and recent Commissioner decisions from 2024-2025.
One year after my research contribution to OneTrust’s compliance platform DataGuidance regarding data breach notifications in Cyprus, I have updated this year’s white paper with significant developments.
The Convergence of GDPR, NIS2 and DORA
The most significant change concerns the interconnection of GDPR with new European legislation. In Cyprus, the NIS2 Directive was transposed through Law 89(I)/2020, while the DORA Regulation applies directly to financial entities through CySEC Circular C700 (April 2025).
This means that in cases of data breaches involving cybersecurity incidents, organizations must examine not only GDPR but also whether more specific frameworks such as NIS2 (for critical sectors) or DORA (for financial services) apply, which may impose additional or more stringent notification obligations.
Cyprus-Specific Exception: Article 12
My updated analysis examines in depth Article 12 of Law 125(I)/2018, which maintains the same substantive requirements as Article 34(3) of GDPR for exceptions from the obligation to notify data subjects (such as encryption, subsequent measures, or disproportionate effort).
However, in Cypriot practical application, data controllers in the majority of cases consult with the Commissioner’s Office before deciding not to notify data subjects, receiving guidance on a case-by-case basis.
Additionally, Article 12 provides data controllers with the possibility to request formal exemption from the Commissioner in sensitive cases involving national security, public safety, or judicial independence (based on Article 23 GDPR), through a formal procedure that includes an impact assessment and prior consultation.
This Year’s Commissioner Decisions
The updated article includes five recent decisions that shape practical application:
- Doctor Case (77/21): Unlawful access to medical data through the GESY System with a fine of €1,500.
- Land Registry Case (21/12/2023): Cyberattack without data breach but with inadequate security measures – imposition of reprimand and order to strengthen security.
- Google Analytics Cases (28/2/2024): Unlawful international data transfers to the USA without fines but with compliance order within one month.
- Health Insurance Organization Case (18/12/2024): Double fine (€1,500 for incomplete response to access request + €3,000 for non-cooperation with the Authority).
- GESY Doctor Case (3/9/2024): Processing beyond purpose with reprimand without fine.
Conclusion.
The update reflects a more complex reality: organizations in Cyprus can no longer examine GDPR in isolation. An integrated approach is required that takes into account sectoral legislation, particularly when a data breach is connected to a cybersecurity incident.
The full updated article is available on the OneTrust DataGuidance platform. If you have any questions regarding data breach notifications or data protection law in Cyprus, please do not hesitate to contact me.
Further Reading
For those interested in exploring data protection and GDPR topics further, I invite you to review my other articles. These cover a broad spectrum of topics, from social discussions to practical applications and critical analyses:
- When the GDPR goes wrong…: A critical look at the weaknesses and potential negative consequences of GDPR, including issues of innovation and competitiveness.
- The Consent Paradox: How EU Regulations Enabled Corporate Data Harvesting: A legal analysis examining how European cookie regulations created a surveillance system controlled by 8-10 companies, with academic studies showing that 85% of consent systems violate basic GDPR requirements, transforming privacy protection into “consent theater.”
- Welcome to Facebook’s Post-Data Era: Why GDPR Is a Dangerous Delusion: A provocative perspective on the evolution of technology and data, questioning the effectiveness of GDPR.
- Open Letter: How the European Parliament Threatens Communications Privacy: An analysis of the risks involved in using algorithms to monitor communications, emphasizing the importance of privacy and proportionality in legislation.
Paternity & DNA Testing in Cyprus Family Courts
When family relationships are disputed, scientific evidence becomes essential. Cyprus Family Courts have wielded genetic testing as a tool for establishing paternity since 2006, when Article 24A was introduced to the Children (Affiliation and Legal Status) Law. The legal framework balances the right to truth with fundamental privacy protections, creating a nuanced system where consent remains paramount but refusal carries legal consequences.
In the landmark case Mary Jane Supatan v. Nikola Peristianu (2006) 1 A.A.D. 1417, the Court of Appeal clarified that while courts can issue directions for blood sampling, they cannot compel compliance. What they can do is draw inferences from refusal. This distinction protects constitutional rights while recognizing that DNA evidence, when voluntarily provided, offers near-certainty in paternity disputes. The question is not whether genetic testing violates privacy, but how courts navigate the tension between establishing familial truth and preserving individual autonomy.
The Legal Framework
Article 24A of Law 187/91 grants Family Courts authority to issue directions for hematological, genetic or other appropriate examinations to determine biological paternity. The distinction between directions and orders is critical: the alleged father retains the right to refuse testing without facing contempt proceedings or forced compliance.
However, refusal is not without consequence. When a party declines testing after court directions, the tribunal may draw any inference that appears reasonable under the circumstances. As the Supreme Court held in subsequent appeals, refusal to submit to DNA testing, absent compelling justification, creates a strong inference of paternity when combined with other evidence. The framework protects both the child’s right to know their parentage and the alleged father’s bodily autonomy, resolving the tension through evidentiary inference rather than physical compulsion.
Privacy Rights and Consent
The intersection of genetic testing with privacy rights remains carefully guarded. Article 15 of the Cyprus Constitution and Article 8 of the European Convention on Human Rights protect private and family life from arbitrary interference. Medical procedures, including blood sampling, constitute interventions that require legal justification and individual consent.
Cyprus legislation respects these protections while recognizing that family law disputes involve competing rights: the mother’s right to establish paternity, the child’s right to know their biological parents, and the alleged father’s right to privacy and bodily integrity. The system resolves this through procedural safeguards: courts issue directions only when paternity is genuinely disputed, testing follows medical protocols that protect data confidentiality, and results are used strictly for the judicial proceedings at hand. This calibrated approach ensures that genetic evidence serves justice without becoming an instrument of invasive state power.
When DNA Testing Becomes Necessary
Paternity disputes typically arise in three contexts: mothers seeking child support from alleged fathers who deny parentage, fathers seeking custody or contact rights when mothers dispute biological connection, and inheritance cases where legitimacy determines estate distribution. In each scenario, genetic evidence can resolve factual disputes that would otherwise devolve into credibility contests with limited probative value.
Strategic timing matters. Requesting DNA testing early in proceedings demonstrates good faith and can accelerate resolution, particularly when the alleged father genuinely doubts paternity. Conversely, waiting until trial to raise testing objections may be interpreted as tactical delay rather than principled opposition. For mothers pursuing support claims, establishing biological paternity is typically the first step toward obtaining maintenance orders. For alleged fathers, voluntary testing that excludes paternity provides complete defense, while refusal to test when paternity is plausible creates evidentiary burdens that are difficult to overcome. The legal framework makes cooperation advantageous when one is confident in the biological facts, and makes refusal costly when doubt exists.
Foreclosures in Cyprus: Procedure, Rights, Case Law
When the GDPR goes wrong…
This article discusses the unseen danger when the EU data-commissioners start capriciously implying the vague text of GDPR.
Pump and Dump: Criminal Law & Regulatory Review
Market manipulation through pump and dump schemes has evolved from boiler rooms and cold calls to sophisticated digital operations. What once required armies of brokers now happens through instant messaging groups, social media campaigns, and algorithmic trading—transforming penny stocks and cryptocurrencies into weapons of mass deception.
Three elements drive these schemes: false representation through misleading information, coordinated buying to create artificial demand, and the strategic exit that leaves victims holding worthless assets. The legal framework spans from the Fraud Act 2006’s provisions on dishonest representation to specialized regulations under FSMA and MAR, turning market manipulation from a grey area into prosecutable criminal conduct.
The anatomy of deception
Modern pump and dump schemes leverage technology to orchestrate mass financial fraud. Operators recruit participants through channels explicitly advertising their intentions, coordinate purchases down to the second, and profit from information asymmetry that would make traditional fraudsters envious.
The Wrong Number Scam of 2005 exemplifies the evolution—910,000 fraudulent voicemails masquerading as mistaken hot tips. Today’s schemes are more subtle: influencers with undisclosed positions, coordinated social media campaigns, and algorithmic amplification that creates the illusion of organic market interest.
Legal boundaries & enforcement
The challenge lies in proving dishonesty when participants claim they’re merely enthusiastic investors. Cases like Navinder Singh Sarao demonstrate that courts can pierce through sophisticated facades, recognizing false representation even when wrapped in legitimate market mechanics.
Yet enforcement remains fragmented. The FCA handles market abuse, while criminal fraud falls to the CPS. Private prosecutions face hurdles, as Burford Capital discovered when seeking Norwich Pharmacal relief. The result: a regulatory maze where market manipulation thrives in the gaps between jurisdictions.
The enforcement challenge
Prosecutors face a perfect storm: proving intent in a sea of plausible deniability, coordinating across multiple jurisdictions where servers, operators, and victims span continents, and keeping pace with schemes that evolve faster than legislation. The shift from result-based crimes to conduct-based offences under the Fraud Act 2006 helps, but questions of dishonesty remain contested terrain.
The Ivey case provides the framework—dishonesty judged by objective standards of reasonable people. But applying 18th-century moral concepts to 21st-century financial engineering creates friction. When does aggressive marketing become false representation? Where’s the line between market making and manipulation? These aren’t just legal questions—they’re existential challenges to market integrity.
Dive into the comprehensive analysis of market manipulation from a pan-European perspective. This monograph maps the evolution from historical cases like the 1814 Berenger scandal to modern cryptocurrency schemes coordinated through Discord and Telegram. Explore how different jurisdictions—US, UK, and EU—approach the challenge of defining and prosecuting market manipulation. The paper examines the regulatory frameworks of MAR, MAD II, and MiFID II, dissects the LIBOR/EURIBOR manipulation saga, and questions whether international coordination can ever catch up to the speed of digital fraud. Essential reading for understanding the structural vulnerabilities that enable pump and dump schemes to flourish in OTC markets and the emerging cryptocurrency ecosystem.
Focused specifically on English criminal law, this white paper examines whether Section 2 of the Fraud Act 2006 adequately criminalizes contemporary pump and dump techniques. Through detailed case analysis including Navinder Singh Sarao’s spoofing prosecution and Burford Capital’s failed attempt at private prosecution, the paper reveals the tensions between general fraud provisions and specialized market abuse regulations. It traces the evolution from the Theft Act 1968’s deception offences to the conduct-based approach of 2006, examining how courts apply the Ivey test for dishonesty to complex financial schemes. The analysis questions whether traditional concepts of fraud can encompass algorithmic manipulation, social media coordination, and the grey areas where aggressive marketing meets criminal misrepresentation—crucial for practitioners navigating the intersection of criminal and regulatory enforcement.
My Journey: from Digital Marketing to Law, and why I started my own Law Office
In this blog post, I want to share my personal journey and mainly the reasons behind my decision to open my own law office, despite having only four years of experience as a lawyer. I understand that some readers may question my capability and wonder how I can be so confident in my abilities. I hope to address those concerns and shed light on the unique blend of experiences that have shaped my career path. By sharing my story, I hope to inspire others to pursue their passions and embrace the value of diverse experiences in shaping their professional paths.




