GreeceGDPR Articles 82-83 and HDPA Enforcement in Greece
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Law 4624/2019 Art. 38 (Criminal penalties) punishes unauthorised interference with a personal-data filing system with imprisonment of up to 1 year (Art. 38(1)); unauthorised use, transmission, disclosure or making the data accessible to unauthorised persons with imprisonment (Art. 38(2)); the same acts involving special-category data or criminal-conviction data with imprisonment of at least 1 year plus a fine of up to EUR 100,000 (Art. 38(3)); the same acts committed for unlawful gain or to cause harm, where the profit or loss exceeds EUR 120,000, with incarceration of up to 10 years (Art. 38(4)); and the same acts where they risk the free functioning of democracy or national security, with imprisonment plus a fine of up to EUR 300,000 (Art. 38(5)). Article 81 extends Article 38 to processing by competent authorities under the Law Enforcement Directive transposition (Chapter D).
Penalty structure
Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the gravest infringement categories. Article 83(4) sets a lower tier, up to EUR 10,000,000 or 2 percent, for other listed provisions. Greek Law 4624/2019 Article 39(1) separately caps the administrative fine the Authority may impose on a body of the public sector at a fixed EUR 10,000,000, in place of the general Article 83 turnover-linked structure, for the GDPR and national-law provisions Article 39(1)(a) to (c) enumerates.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Greece's independent supervisory authority under Law 4624/2019 Art. 9, originally established by Law 2472/1997.
Enforcement record
The HDPA's own press release announcing its 2024 Annual Report (published ): in calendar year 2024, the Authority issued 46 decisions concerning violations of the law, of which 22 decisions imposed fines totalling EUR 4,302,149. The same report records 1,820 complaints lodged (up from 1,414 in 2023) and 1,422 handled (up from 883 in 2023). Counts the HDPA's own public enforcement decisions only; does not separately track private civil claims under GDPR Article 82. This is the HDPA's enforcement record as a whole, not specific to Articles 82-83 alone.
- As of
- Currency
- EUR
- Source link
- https://www.dpa.gr/en/enimerwtiko/press-releases/president-k-menoudakos-submits-2024-annual-report-president-hellenic
- Fines per year
- 4,302,149
- Actions per year
- 46
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Greek rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a right to compensation, and Article 83 and Article 39 of the Law set fines. They state no duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation, and the Authority's power to audit sits in Article 15 of the Law, which this row does not cite.
- Kind
- None
- As of
What this law does
The Hellenic Data Protection Authority (HDPA) is the supervisory authority. Under Article 39(1) of Law 4624/2019, the Authority can impose on a body of the public sector, with the exceptions that Article 39(1) lists, an administrative fine of up to EUR 10,000,000 for infringements of the General Data Protection Regulation (GDPR) provisions that Article 39(1)(a) and (b) name and of the provisions of the Law that Article 39(1)(c) names.
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .