Operates a social platform, in Greece

Law 4779/2021 (Nomos 4779/2021), FEK A' 27/20.02.2021, art. 32, transposing AVMSD art. 28b · Read the law's page

• Applies only to video-sharing platforms and social networks established in Greece whose video content is functionally separable from the rest of the service.
• Take appropriate and feasible measures to protect minors from content that may impair their development.
• Also protect the wider public from content inciting violence or hatred, or amounting to child pornography, terrorism, xenophobia or racism offences under EU law.
• Apply the strictest access-control measures to the most harmful content, including, as appropriate, systems that verify platform users' ages and parental-control systems, so that minors cannot reach content that may harm their physical, psychological or moral development.
• Submit data to the National Council for Radio and Television (ESR) every year: complaints received and resolved by category, out-of-court settlements, and the parental-control or age-verification systems and media-literacy measures you adopted.

Law 5099/2024, Articles 4, 5, 11, 15, 16, 17 and 20 (Ν. 5099/2024, ΦΕΚ Α’ 48/05.04.2024), Part A · Read the law's page

• If your main establishment is in Greece, file a registration declaration in the Register of Providers of Intermediary Services kept by the National Telecommunications and Postal Commission; the Law set the deadline at three months from the day the Register began to operate, and no approval act is required (Article 15(2) and (3) of Law 5099/2024).
• Tell the Register of any change to the details it holds about you without delay and within ten days at the latest (Article 15(5) of Law 5099/2024).
• Give the Digital Services Coordinator the information it requests by a specific and reasoned request without delay, and within 20 working days of the request where it sets no deadline (Article 11(1)(a) of Law 5099/2024).
• Pay the annual supervisory fee that the Digital Services Coordinator imposes on you under Article 20 of Law 5099/2024, if it imposes one.

Law 5099/2024, Articles 9 and 12 (Ν. 5099/2024, ΦΕΚ Α’ 48/05.04.2024), Part A · Read the law's page

• If Article 18 of Regulation (EU) 2022/2065 obliges you to report a suspected criminal offence, send the report in Greece to the Electronic Crime Prosecution Directorate of the Hellenic Police, which Article 9 of Law 5099/2024 names as the authority that receives such reports.
• Act on an order to act against illegal content that a Greek judicial or public authority sends you under Article 9 of Regulation (EU) 2022/2065; an order of a public authority that does not meet the conditions of Article 9(2) is non-existent for the purposes of the Regulation (Article 12 of Law 5099/2024).

Law 5160/2024 (Ν. 5160/2024), Art. 16 · Read the law's page

• This binds an essential entity or an important entity drawn from Annex I or Annex II, on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, reached at the medium-enterprise threshold or above; the wider sector classes are reached as on that row. A financial entity covered by Regulation (EU) 2022/2554 reports under that Regulation instead, because Article 5, paragraph 3 sets the incident-reporting provisions of this Law aside for it, while it must still cooperate with the National Cybersecurity Authority.
• Notify the CSIRT of the National Cybersecurity Authority, without undue delay and in any case within 24 hours of becoming aware of a significant incident, with an early warning stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects.
• Follow within 72 hours of becoming aware of the significant incident with an incident notification updating the early warning and adding an initial assessment of its severity and effects.
• Submit an interim report if the National Cybersecurity Authority requests one.
• Submit a final report no later than one month after the 72-hour notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border impact; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of its resolution.
• If you are a trust-service provider, notify the National Cybersecurity Authority of a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour notification.
• Without undue delay, notify the recipients of your services of a significant incident likely to adversely affect the services they receive, and inform any recipients affected by a significant cyber threat of the threat and of the measures they can take in response.

Law 5160/2024 (Ν. 5160/2024), Arts. 14-15 · Read the law's page

• Within three months of this duty's entry into force, have your management body approve the cybersecurity risk-management measures you take to comply with the measures below, supervise their implementation, and ensure every board member receives training and that equivalent training reaches your staff at least annually.
• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your activities or to provide your services, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.
• Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where relevant, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication and secure voice, video, text and emergency communications.
• Designate a qualified staff member as ICT Security Officer (Υ.Α.Σ.Π.Ε.), who manages communications with the National Cybersecurity Authority and coordinates compliance and incident reporting internally, keep a unified cybersecurity policy (an essential entity submits it to the Authority for approval at least annually), and keep an inventory of your information and communication assets ranked by criticality.
• This binds an essential entity or an important entity drawn from Annex I (high-criticality sectors) or Annex II (other critical sectors), which the law's own table of contents captions as corresponding directly to NIS2 Directive Annexes I and II; Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform (each a defined term in Article 6), reached at the medium-enterprise threshold of Commission Recommendation 2003/361/EC or above (Article 3(1)); the wider sector classes Annexes I and II reach by designation (energy, transport, banking, health, drinking water, public administration and the rest) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 5, paragraph 3 sets the risk-management and supervision provisions of this Law aside for it, while it must still cooperate with the National Cybersecurity Authority.

Law 5172/2025, Article 12 (Ν. 5172/2025, ΦΕΚ Α’ 10/29.01.2025) · Read the law's page

• If you manage a website or host its content, remove the content that a Greek prosecutor orders removed under Article 12 of Law 5172/2025 within 24 hours of service of the order, and send a declaration of compliance.
• If you provide internet access and are registered in the Register of Providers of Electronic Communications Networks and Services, cut off access to the domain name or IP address named in a prosecutor's order that the National Telecommunications and Postal Commission passes to you, and send the Commission a declaration of compliance stating the time access was cut off within 24 hours of receiving the order.

Law 5350/2026 (Nomos 5350/2026), FEK A' 177/26.10.2026, adding Article 4A to Law 5099/2024 · Read the law's page

• Do not give a minor who has not completed the fifteenth year of age access to an online social-networking service provided by an online platform; Article 4A(1) of Law 5099/2024 prohibits that access.
• To check age you may use the age-verification functionality of the digital document repository under Law 4954/2022, or the KidsWallet application; Article 4A(1) says these may be used and does not make either mandatory.
• When applying the age limit, treat 1 January as the date of birth of everyone born in the same calendar year.