Cloud computing is already part of everyday business in Cyprus, but the next challenge is not simply to use more of it. Companies now need to think more carefully about security, resilience, data control and dependence on providers, according to Cyprus Information Technology Enterprises Association (CITEA) director Matina Zisiadou.

“Cloud technology had moved well beyond something businesses could regard as a future development,” Zisiadou said. Email, file storage, workplace applications, accounting systems and databases are already among the services operating through the cloud, often without companies giving much thought to the infrastructure behind them.

She pointed to the latest available Eurostat figures for 2025, which show that one in two businesses in Cyprus with 10 or more employees used paid cloud services, putting the island close to the EU average.

The European Commission’s Digital Decade 2026 report, she added, also describes Cyprus’ adoption of advanced technologies such as cloud and data analytics as relatively advanced.

That growing use reflects one of cloud computing’s main attractions, with Zisiadou explaining that “businesses no longer need to invest from the outset in their own infrastructure whenever they require more computing power, storage or new applications.” Instead, “they can access those services according to their needs and adjust them as those needs change,” she said.

The flexibility, however, brings a different set of considerations.

As more of a company’s operations move to the cloud, businesses inevitably have to ask “where is the data stored, who has access to it, what happens if a service stops working, is there a backup and how quickly can the business return to normal operations,” Zisiadou said.

Those questions mean choosing a provider is only one part of the decision. Businesses also need to know which systems and data are critical, how access is controlled, what backup arrangements are in place and how quickly operations could recover if a service were disrupted.

The same shift is now taking place at government level in Cyprus.

Zisiadou referred to the Cloud Policy of the Republic of Cyprus, approved by the Council of Ministers in March 2026, which adopted the “Cloud First” principle and made cloud the default direction for government systems and applications, with alternatives provided for only in exceptional circumstances and following documented approval.

Under that approach, G-Cloud, or Government Cloud, is intended to become the main infrastructure for hosting government systems and applications, replacing a model in which individual departments build and manage separate infrastructure with a more organised and centralised environment.

For Zisiadou, however, the significance goes beyond where government applications are hosted.

The policy also addresses security, data hosting and sovereignty, as well as business continuity, matters she said were particularly important in the public sector. It is not enough for a system simply to be available, “because data also needs to be protected, access controlled and critical public services able to continue operating when technical problems or other disruptions occur,” she argued.

Cyprus had already started building towards that model before the policy was approved. Zisiadou pointed to the completion in November 2025 of two data centres for hosting government systems, backed by €5.96 million in European funding under the Recovery and Resilience Plan.

“This mattered beyond government because it showed cloud was increasingly being treated not simply as another technology option, but as part of the country’s wider digital infrastructure,” she said.

That, in turn, has implications for the private sector.

As the public sector develops a more structured cloud environment, “new needs and opportunities are also emerging for Cyprus’ technology market, particularly in cybersecurity, data management, cloud applications, managed services and systems integration,” Zisiadou said.

The broader European discussion is moving in much the same direction, with cloud computing increasingly linked to digital sovereignty.

Zisiadou referred to the European Commission’s proposed Cloud and AI Development Act, which aims to strengthen Europe’s capacity in cloud computing and data centres, including plans to at least triple data-centre capacity across the EU over the coming years.

At the same time, the EU has developed a Cloud Sovereignty Framework for its own cloud services, covering issues including jurisdiction, data access, technological autonomy, security, supply chains and compliance, she said.

For businesses, however, those wider policy questions eventually become far more practical.

Companies increasingly need to ask not only how much the service costs, but also “where is our data stored, how dependent are we on one provider and how easily can we change direction if necessary,” Zisiadou said.

Those questions are becoming more important as a growing share of business activity depends on digital services, although the answers will differ considerably from one company to another.

A small business will not have the same needs as a large organisation, Zisiadou said, while a company handling sensitive data will face different challenges from one primarily looking for flexibility and speed.

Cyprus already has a technology ecosystem with experience in cloud infrastructure, data centres, managed services, cybersecurity, systems integration and digital transformation, she added, giving businesses access to expertise across those areas.

The next step, in her view, is for companies to use that expertise and stop treating cloud merely as a different place to host their systems.

Instead, it should be viewed as a business decision, with a sound strategy answering some basic but increasingly important questions: what the company actually needs, which data is critical, how that data is protected, how dependent the business is on a particular provider and how resilient the organisation would be if something went wrong, she said.

That is why Cyprus is now moving beyond the question of cloud adoption itself, Zisiadou said. “For Cyprus, the next step is therefore not simply to use more cloud, it is to use cloud securely, strategically and in a way that creates real value for businesses,” she said.