On 3 September 2026, the Court of Justice of the European Union (CJEU) delivered an important judgment concerning the balance between corporate transparency and the protection of personal data.

The case, C-798/24 (Jautiva), concerned Latvian legislation that allowed information relating to shareholders of public limited liability companies, including minority shareholders, to be made available online to the general public.

The Court clarified that EU company law does not require information relating to all shareholders to be publicly disclosed. In particular, simply holding shares in a company does not necessarily mean that an individual exercises management, supervisory or controlling functions.

The judgment also considered the issue from a data protection perspective. The CJEU found that making shareholders’ personal information available to anyone, without conditions such as demonstrating a legitimate interest, is incompatible with the GDPR where such unrestricted access is not necessary and proportionate.

This is particularly important for minority shareholders. Publicly available information concerning an individual’s shareholdings, voting rights and contact details may reveal aspects of their financial position and business interests. The Court recognised that legitimate objectives such as corporate transparency, anti-money laundering and sanctions compliance may justify access to certain information, but they do not automatically justify unrestricted public access.

For Cyprus, the judgment is particularly relevant because information concerning company members may be accessible through the Registrar of Companies. It does not automatically change Cyprus’ existing disclosure requirements, but it provides an important framework for assessing how shareholder information should be made available.

The decision reflects a wider development in EU law: corporate transparency remains important, but it must be balanced against privacy and data protection rights.

For companies, shareholders and professionals in Cyprus, the judgment is another reminder that access to corporate information must comply not only with company law, but also with the principles of necessity, proportionality and personal data protection.