GreecePenal Code Article 370D (370Δ), Access to an Information System in Breach of a Prohibition or Security Measure
Poinikos Kodikas art. 370D (370Δ), para. 2, as ratified by Law 4619/2019 (FEK A' 95/11.06.2019); formerly art. 370C, para. 2, as replaced by Law 4411/2016, art. 2 para. 6 (FEK A' 142/3.8.2016)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access all or part of an information system, or data transmitted over a telecommunications system, by violating a prohibition or a security measure the lawful holder has put in place.
- Crawling a public, unauthenticated page that carries neither a stated prohibition nor a technical access control has not itself been held to violate this article.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Paragraph 1: a fine or community service for without-right copying or use of a computer program. Paragraph 2: imprisonment for without-right access to all or part of an information system or to data transmitted by telecommunications systems, violating a prohibition or a security measure of the lawful holder. Paragraph 3 punishes the same paragraph-2 act only where an offender in the lawful holder's service was expressly prohibited from it by internal regulation or a written decision of the holder or a competent employee.
Who enforces it
Settledness
- As of
- Open questions
- Does a prohibition written in a website's terms of use count as an 'απαγόρευση' (prohibition) under Article 370D paragraph 2, or does the paragraph require a technical 'μέτρο ασφαλείας' (security measure)?
- Is access to pages that the operator serves to the public made 'χωρίς δικαίωμα' (without right) under Article 370D paragraph 2 when it breaches only a contractual prohibition?
What it makes you log
Logging duty
Article 370D makes it an offence to copy or use computer programs without right and to gain access to an information system in breach of a prohibition or security measure. It imposes no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 370D of the Penal Code (370Δ in the Greek text) punishes without-right copying or use of computer programs with a fine or community service (paragraph 1), and separately punishes without-right access to all or part of an information system, or to data transmitted by telecommunications systems, where the actor violates a prohibition or a security measure the lawful holder has put in place, with imprisonment (paragraph 2).
Where the actor is in the lawful holder's service, paragraph 3 punishes the paragraph-2 act only if an internal regulation, or a written decision of the holder or a competent employee, expressly prohibits it. A neighbouring provision, Article 370E, is a separate offence: unauthorised technical interception of non-public data transmissions or electromagnetic emissions to, from or within an information system, punished with imprisonment of at least three years and a fine.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .