GreeceLaw 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices
Ν. 4961/2022 (ΦΕΚ Α' 146/27.07.2022), Chapter Γ' of Part B, Arts. 32-42
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Security, Disclosure, Governance
As of .
What it requires
- If you manufacture, import or distribute an Internet of Things device intended for operators of essential services, digital service providers or local government organizations in Greece, design it to reach an appropriate level of cybersecurity throughout its life cycle, with measures such as secure passwords, timely software updates from trusted sources, encryption of critical security data in transit and a vulnerability disclosure policy or procedure (Law 4961/2022, Article 32). Devices used by the National Intelligence Service and the Ministry of National Defence are outside the chapter.
- As a manufacturer, supply each such device with a declaration of conformity to the technical security specifications set by ministerial decision under Article 113, paragraph 12α, together with instructions for use and security information that end users can easily understand, keep the declaration, and give it to the National Cybersecurity Authority or the competent response team on request (Article 33(1) to (3)).
- As a manufacturer that learns a device does not comply with those specifications, inform the importer, the National Cybersecurity Authority and the competent response team immediately (Article 33(5)).
- As a manufacturer, keep for each device a procedure for handling an incident or vulnerability that a user finds, documenting its nature, giving detailed instructions for dealing with it and listing mitigation measures (Article 39).
- As an importer or distributor, check before supplying a device to an Internet of Things operator that it comes with the declaration of conformity, and stop supplying a device you know does not comply until it does, informing the manufacturer and, if it has already been supplied, the authority, the response team and the distributor or operators using it (Article 34).
- If you are an operator of essential services, a digital service provider or a local government organization using such devices, use them in accordance with the technical security specifications, appoint an Internet of Things Security Officer, keep a register of the devices you use and update it annually, suspend use of a device that presents a risk, and carry out a data protection impact assessment of the related processing (Articles 35, 37(2), 38 and 41(2)).
If you get it wrong
Criminal exposureNo
Penalty structure
Article 42 names sanctions only for an Internet of Things operator, in escalating order: a recommendation, a reprimand, a fine of up to EUR 15,000 if the operator does not comply with the reprimand, and, on repetition, a fine of up to EUR 100,000.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας), which Article 36(1) charges with checking compliance with Articles 32 to 35, together with the competent response team; the competent organ of the Ministry of Digital Governance imposes the Article 42 sanctions on a reasoned recommendation of the Authority.
What this law does
Article 30(1) applies Chapter Γ' of Part B to Internet of Things devices used by operators of essential services, digital service providers and local government organizations, and excludes devices used by the National Intelligence Service and the Ministry of National Defence and its supervised bodies.
Article 32(1) requires Internet of Things devices to be designed and developed to reach an appropriate level of cybersecurity throughout their life cycle and to prevent unauthorized third parties from altering their use or performance.
Article 32(2) requires devices to incorporate, as use and risk make appropriate, measures such as secure passwords, timely software updates from trusted sources, encryption of critical security data in transit, a public contact point for reporting security incidents, and a policy or procedure for disclosing vulnerabilities or security incidents.
Article 33(1) requires a device intended for supply to Internet of Things operators to be accompanied by the manufacturer's declaration that it complies with the technical security specifications set by ministerial decision under Article 113, paragraph 12α. Article 33(2) requires the declaration to come with instructions for use and security information in terms that end users can easily understand.
Article 33(5) requires a manufacturer that learns a device does not comply with those specifications to inform the importer, the National Cybersecurity Authority and the competent response team immediately. Article 34(1) requires an importer, before supplying a device to Internet of Things operators, to verify that it comes with the declaration of conformity and to make the declaration available to the authority or response team on request.
Article 34(2) requires an importer that learns a device does not comply to stop supplying it until it does, and to inform the manufacturer and, if the device has already been supplied, the authority, the response team and the distributor or operators using it. Article 34(4) applies those importer duties to distributors that supply devices to Internet of Things operators.
Article 35(1) requires Internet of Things operators to use their devices in accordance with the technical security specifications set by that ministerial decision. Article 35(2) requires each operator to appoint an Internet of Things Security Officer to monitor the proper execution of the technical and organizational measures that a further ministerial decision under Article 113, paragraph 12β sets.
Article 35(4) requires an operator whose Security Officer suspects a device presents a risk to inform the authority, the response team, the manufacturer, the importer and the distributor without undue delay and to suspend use of the device to the extent it considers necessary. Article 38(1) requires each operator to keep a register of the devices it uses, update it annually and whenever it commissions a new device, and make it available to the authority or response team on request.
Article 39 requires a manufacturer to have, for each device, a procedure for handling an incident or a vulnerability that a user finds, with documentation of its nature, detailed instructions for dealing with it and mitigation measures. Article 41(2) requires each operator to carry out a data protection impact assessment of the planned processing of personal data related to the operation of the device, in accordance with Article 35(1) of the General Data Protection Regulation.
Article 42 lets the competent organ of the Ministry of Digital Governance, on a reasoned recommendation of the National Cybersecurity Authority, impose on an operator that fails its duties escalating sanctions: a recommendation, a reprimand, a fine of up to EUR 15,000 and, on repetition, a fine of up to EUR 100,000.
Article 113, paragraph 12α, leaves the technical security specifications for devices intended for Internet of Things operators, including the Article 32 measures, to a decision of the Minister of Digital Governance on the recommendation of the National Cybersecurity Authority. Article 116(3) provides that Chapter Γ' of Part B takes effect on .
When LexLint raises it
When your app profile says your app distributes a software product or runs an essential service.