GDPR Articles 82-83 and HDPA Enforcement in Greece

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Law 4624/2019 Art. 38 (Criminal penalties) punishes unauthorised interference with a personal-data filing system with imprisonment of up to 1 year (Art. 38(1)); unauthorised use, transmission, disclosure or making the data accessible to unauthorised persons with imprisonment (Art. 38(2)); the same acts involving special-category data or criminal-conviction data with imprisonment of at least 1 year plus a fine of up to EUR 100,000 (Art. 38(3)); the same acts committed for unlawful gain or to cause harm, where the profit or loss exceeds EUR 120,000, with incarceration of up to 10 years (Art. 38(4)); and the same acts where they risk the free functioning of democracy or national security, with imprisonment plus a fine of up to EUR 300,000 (Art. 38(5)). Article 81 extends Article 38 to processing by competent authorities under the Law Enforcement Directive transposition (Chapter D).

Penalty structure

Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the gravest infringement categories. Article 83(4) sets a lower tier, up to EUR 10,000,000 or 2 percent, for other listed provisions. Greek Law 4624/2019 Article 39(1) separately caps the administrative fine the Authority may impose on a body of the public sector at a fixed EUR 10,000,000, in place of the general Article 83 turnover-linked structure, for the GDPR and national-law provisions Article 39(1)(a) to (c) enumerates.

Rule

Higher of

As of

2 September 2026

Currency

EUR

Fixed cap

20,000,000

Turnover percentage cap

4

Enforcement body

Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Greece's independent supervisory authority under Law 4624/2019 Art. 9, originally established by Law 2472/1997.

Enforcement record

The HDPA's own press release announcing its 2024 Annual Report (published 2025-06-23): in calendar year 2024, the Authority issued 46 decisions concerning violations of the law, of which 22 decisions imposed fines totalling EUR 4,302,149. The same report records 1,820 complaints lodged (up from 1,414 in 2023) and 1,422 handled (up from 883 in 2023). Counts the HDPA's own public enforcement decisions only; does not separately track private civil claims under GDPR Article 82. This is the HDPA's enforcement record as a whole, not specific to Articles 82-83 alone.

As of

2 September 2026

Currency

EUR

Source link

https://www.dpa.gr/en/enimerwtiko/press-releases/president-k-menoudakos-submits-2024-annual-report-president-hellenic

Fines per year

4,302,149

Actions per year

46

Obligation class

Governance