GreeceLaw 5160/2024, Significant-Incident Reporting Obligations
Law 5160/2024 (Ν. 5160/2024), Art. 16
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential entity or an important entity drawn from Annex I or Annex II, on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, reached at the medium-enterprise threshold or above; the wider sector classes are reached as on that row. A financial entity covered by Regulation (EU) 2022/2554 reports under that Regulation instead, because Article 5, paragraph 3 sets the incident-reporting provisions of this Law aside for it, while it must still cooperate with the National Cybersecurity Authority.
- Notify the computer security incident response team (CSIRT) of the National Cybersecurity Authority, without undue delay and in any case within 24 hours of becoming aware of a significant incident, with an early warning stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects.NIST CSF 2.0RS.CO-02
- Follow within 72 hours of becoming aware of the significant incident with an incident notification updating the early warning and adding an initial assessment of its severity and effects.NIST CSF 2.0RS.CO-02
- Submit an interim report if the National Cybersecurity Authority requests one.NIST CSF 2.0RS.CO-03
- Submit a final report no later than one month after the 72-hour notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border impact; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of its resolution.NIST CSF 2.0RS.CO-03
- If you are a trust-service provider, notify the National Cybersecurity Authority of a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour notification.NIST CSF 2.0RS.CO-02
- Without undue delay, notify the recipients of your services of a significant incident likely to adversely affect the services they receive, and inform any recipients affected by a significant cyber threat of the threat and of the measures they can take in response.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 26's own penalty provision for an Article 16 infringement is an administrative fine (διοικητικό πρόστιμο); Law 5160/2024 creates no criminal offence for the infringement. The mere act of notifying does not itself create liability for the notifying entity (Article 16(1)).
Penalty structure
Article 26(4) sets the maximum administrative fine for an essential entity's infringement of Article 15 or 16 at EUR 10,000,000 or 2 percent of the total worldwide annual turnover of the undertaking in the preceding financial year, whichever is higher. Article 26(5), the mirror provision for an important entity, sets the equivalent cap at EUR 7,000,000 or 1.4 percent of that turnover, whichever is higher. Both mirror NIS2 Directive Article 34(4) and (5). The gazette text of paragraph 4 ends with the clause "της επιχείρησης στην οποία ανήκει η σημαντική οντότητα" ("the undertaking to which the important entity belongs"), the same wording as paragraph 5; paragraph 4 opens by naming essential entities, which fixes the class it binds, and the two figures are those NIS2 Article 34(4) and (5) prescribe for essential and important entities.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority, EAK), whose CSIRT receives the notification; for the national-security, public-order, defence and law-enforcement entity class of Article 3(2)(στ), the CSIRT of the Εθνική Υπηρεσία Πληροφοριών (National Intelligence Service) with parallel notice to the EAK.
Settledness
- As of
- Guidance link
- https://cyber.gov.gr/nomothesia/elliniki-nomothesia-gia-tin-kyvernoasfaleia/
- Guidance body
- Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority)
- Open questions
- Article 26(4), the EUR 10,000,000/2% ceiling for essential entities, closes with the same words as paragraph 5, the undertaking "to which the important entity (η σημαντική οντότητα) belongs"; does that clause identify the turnover base for both ceilings, or is paragraph 4 meant to refer to the essential entity?
What this law does
Article 16 requires an essential or important entity to notify, without delay, the computer security incident response team (CSIRT) of the National Cybersecurity Authority of every incident that has a significant impact on the provision of its services (a 'significant incident' under paragraph 3, gated on serious operational disruption or financial loss to the entity, or material harm to other persons).
The notification follows a graduated clock: an early warning within 24 hours of becoming aware of the significant incident, stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects; an incident notification within 72 hours, updating and adding an initial assessment of severity and effects; an interim report if the National Cybersecurity Authority requests one; and a final report no later than one month after the 72-hour notification, covering a detailed description, the type of threat or root cause, mitigating measures, and any cross-border impact, or, for an incident still ongoing at that point, a progress report followed by a final report within one month of its resolution.
A trust-service provider informs the National Cybersecurity Authority of a significant incident affecting its trust services without undue delay and in any case within 24 hours rather than 72. The entity must also, without undue delay, notify service recipients of a significant incident likely to adversely affect the services they receive, and must inform recipients affected by a significant cyber threat of the threat and of measures they can take in response.
Article 5, paragraph 3 sets this Law's provisions on incident-reporting and supervision aside for a financial entity covered by Regulation (EU) 2022/2554, subject to its duty to cooperate with the National Cybersecurity Authority under Article 13. Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity reports under that Regulation instead. This law, Law 5160/2024 (FEK A' 195/27.11.2024), transposes NIS2 Directive Article 23.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .