Businesses need reliable information about the companies they deal with. Shareholders also have a legitimate interest in how their personal information is used. The Jautiva ruling shows why those interests need to be considered together, particularly when company records can be downloaded by anyone online.

The practical question for Cyprus businesses is not simply whether shareholder information must be collected. It is who should have access to it, for what purpose and in what form.

What happened in Jautiva

The case, C-798/24, concerned Latvian rules allowing unrestricted online access to personal information about shareholders of public limited companies, including minority shareholders. Users could download the information in bulk without identifying themselves.

In its judgment of 3 September 2026, the Court of Justice explained that EU company law does not require disclosure of information about every shareholder. It also rejected unconditional online disclosure of the personal data at issue. Corporate transparency, anti-money laundering and sanctions objectives did not, on their own, justify that approach. [1]

The concern extends beyond a person’s name appearing in a register. Combined information can reveal investments and wealth. Once downloaded, it may be retained or passed on far beyond its original purpose. The Court identified conditional access, such as a legitimate-interest requirement, as a possible less intrusive approach. [1]

Filing and public access are different questions

A company may have a duty to maintain records or file information with an authority. It does not follow that every item must also be placed on an unrestricted website.

Cyprus has its own rules under the Companies Law, Cap. 113. These include annual returns, access to the register of members and inspection of documents held by the Registrar. Sections 118, 108 and 365 address different parts of that framework. They should be considered separately when reviewing a particular disclosure. [2]

Jautiva does not automatically cancel those Cyprus requirements. Nor should companies use it as a reason to stop filing information that the law requires. Its value is in supporting a more precise review of public access and the safeguards that apply.

Where businesses can improve their own practices

Start with information shared by choice. A due-diligence folder, investor presentation or company website may contain more personal information than the recipient needs. A document collected for identity checks should not automatically become part of a general transaction pack.

For example, a buyer may need to understand a company’s ownership. That does not necessarily mean everyone with access to the data room needs a shareholder’s identity-document details. The purpose of the disclosure, the recipient’s role and the information needed should be considered before access is given.

Companies should also check how access ends. A former adviser may no longer need a live link to a folder. A completed transaction may justify closing the data room or narrowing permissions. These are practical controls that can often be improved without changing any statutory filing process.

What shareholders should ask

A shareholder concerned about disclosure should identify the particular information and the particular route by which it is available. A request about an unnecessary website upload is different from a challenge to a statutory inspection right. The available response will depend on that distinction.

For Cyprus groups and family offices, the sensible approach is to meet legal disclosure duties while limiting additional sharing to what is needed. That supports proper due diligence and reduces unnecessary exposure of personal information.

AGPLAW advises on GDPR and data protection alongside corporate law.

Sources [1]: Court of Justice official summary of Jautiva. [2]: Cyprus Companies Law, sections 108, 118 and 365.

Disclaimer: This article provides general information and is not legal advice on a specific matter.