GreecePenal Code Article 370C (370Γ), Violation of Computer Data and Program Secrets
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not copy, record, use, or disclose to a third party computer data or programs that constitute a state, scientific, professional, or business secret, where the lawful holder treats them as secret from a justified interest, without right.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of at least three months for the base offence (paragraph 1); imprisonment of at least one year where the offender is in the lawful holder's service, or the secret is of especially great economic significance (paragraph 2). The acts are prosecuted on a complaint (paragraph 3).
Who enforces it
Settledness
- As of
- Open questions
- Does business data that an operator publishes openly on a web page remain an 'απόρρητο επιχείρησης' (business secret) under Article 370C paragraph 1 when the operator's terms of use treat it as confidential?
- Does copying openly served data 'αθέμιτα' (unlawfully) under Article 370C paragraph 1 depend on circumventing any technical barrier?
What it makes you log
Logging duty
Article 370C(1) makes it an offence to copy, record, use, disclose or otherwise violate data or computer programs that are state, scientific, professional or business secrets. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 370C of the Penal Code (370Γ in the Greek text) punishes unlawfully copying, recording, using, disclosing to a third party, or otherwise violating computer data or programs that constitute a state, scientific, professional, or business secret of the public or private sector, with imprisonment of at least three months.
Data also counts as secret where the lawful holder, from a justified interest, treats it as secret, particularly where it has taken measures to keep third parties from learning of it, and paragraph 2 raises the minimum to one year where the offender is in the holder's service or the secret is of especially great economic significance. Under paragraph 3 the acts are prosecuted on a complaint.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .