Greece

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Secondary commentary (Centraleyes, Practical Law) describes Law 4624/2019 as adding a derogation grouping genetic, biometric, and health data together, permitting their processing where necessary for social security or social protection purposes, or to assess an employee's fitness for work.

The provision's exact article number, and whether it enumerates biometric modalities individually, are not asserted; the grouping itself is stated at medium confidence, commentary sourced. No Greece-specific voiceprint or faceprint case or regulatory guidance is known.

A controller must notify the Hellenic Data Protection Authority (HDPA) without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Greece, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Law 4624/2019 derogation from this timeline is identified.

Greece's private-sector regime is the General Data Protection Regulation (GDPR) plus Law 4624/2019 (Greek: Nomos 4624/2019), FEK A' 137/29-08-2019, in force from publication on 29 August 2019, which supplies domestic derogations and procedural rules, including an employment chapter narrowing consent as a lawful basis for employee data processing and separately regulating workplace video surveillance. The Hellenic Data Protection Authority (HDPA) is the supervisory authority.

The HDPA's own official English translation PDF does not yield extractable text, so the employment chapter's exact article numbers and text are not independently confirmed and are described here only in general terms, per secondary legal commentary.

Transferring personal data of a person in Greece outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Law 4624/2019 derogation broadening or narrowing this is identified.

General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing, restated without narrowing by Law 4624/2019.

Secondary commentary describes an employment chapter, commonly cited as Article 27, that makes employee consent lawful only in exceptional cases assessed against the employee's dependence in the employment relationship, and separately requires written notice to employees before workplace video surveillance is installed, limited to protection of persons and property.

This chapter's exact article numbers and text are not independently confirmed, since the HDPA's own official translation PDF does not yield readable text.

The Hellenic Data Protection Authority (HDPA) is the supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. In 2024 the HDPA issued an administrative fine and compliance order against the Ministry of Migration and Asylum, reported by the European Data Protection Board (EDPB)'s national news feed. No Greece-specific fine ceiling beyond the GDPR Article 83 maximum, and no dedicated collective-redress statute for data-protection claims, is identified.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Article 370B punishes copying, recording, using, disclosing to a third party, or otherwise violating computer data or programs that constitute a state, scientific, professional, or business secret of the public or private sector, without right, with imprisonment of at least three months.

The offence reaches data the lawful holder treats as secret from a justified interest, particularly where it has taken measures to keep third parties from learning of it, and paragraph 2 raises the minimum to one year where the offender is in the holder's service or the secret is of especially great economic significance.

Article 370C of the Penal Code, titled Illegal Access to an Information System, punishes without-right copying or use of computer programs with up to six months' imprisonment and a fine of 290 to 5,900 euro (paragraph 1), and separately punishes without-right access to all or part of an information system, or to data transmitted by telecommunications systems, where the actor violates a prohibition or a security measure the lawful holder has put in place, with imprisonment (paragraph 2).

A neighbouring provision, Article 370D, is a separate offence: unauthorised technical interception of non-public data transmissions or electromagnetic emissions to, from or within an information system, punished with incarceration of up to ten years.

Article 14 requires the management body of an essential or important entity to approve, within three months of this law's entry into force, the cybersecurity risk-management measures the entity takes to comply with Article 15, to supervise their implementation, and holds the management body responsible for the entity's breach of this duty; its members must undergo training and ensure the entity provides equivalent training to its staff at least annually.

Article 15 requires appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems the entity uses for its activities or to provide its services, and to prevent or minimise the impact of an incident on the recipients of its services or on other services, at a level of security proportionate to the risk, covering at minimum: risk-analysis and information-system security policy; incident handling; business continuity including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of risk-management measures; basic cyber-hygiene practices and cybersecurity training; cryptography and, where relevant, encryption policy; human-resources security, access-control policy and asset management; and the use of multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency-communications systems.

This law, Law 5160/2024 (FEK A' 195/27.11.2024), transposes NIS2 Directive Article 20 (Article 14) and Article 21 (Article 15).

Article 16 requires an essential or important entity to notify, without delay, the CSIRT of the National Cybersecurity Authority of every incident that has a significant impact on the provision of its services (a 'significant incident' under paragraph 3, gated on serious operational disruption or financial loss to the entity, or material harm to other persons).

The notification follows a graduated clock: an early warning within 24 hours of becoming aware of the significant incident, stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects; an incident notification within 72 hours, updating and adding an initial assessment of severity and effects; an interim report if the National Cybersecurity Authority requests one; and a final report no later than one month after the 72-hour notification, covering a detailed description, the type of threat or root cause, mitigating measures, and any cross-border impact, or, for an incident still ongoing at that point, a progress report followed by a final report within one month of its resolution.

The entity must also, without undue delay, notify service recipients of a significant incident likely to adversely affect the services they receive, and must inform recipients affected by a significant cyber threat of the threat and of measures they can take in response. This law, Law 5160/2024 (FEK A' 195/27.11.2024), transposes NIS2 Directive Article 23.

Article 32 of Law 4779/2021 assigns the National Council for Radio and Television (ESR) to apply AVMSD Article 28b to video-sharing platforms and social networks established in Greece whose video content is functionally separable from the rest of the service.

The duty requires appropriate and feasible measures protecting minors from content that may impair their development, and separately protects the wider public from content inciting violence or hatred or amounting to child pornography, terrorism, xenophobia, or racism offences under EU law.

A covered provider must submit data to ESR annually under Article 32 paragraph 10, covering complaints received and resolved by category, out-of-court settlements, and the parental-control or age-verification systems and media-literacy measures adopted. ESR's competence reaches only providers established in Greece. ESR may impose sanctions for noncompliance under Article 36 of the same Law.

A press publisher established in an EU member state has the exclusive right to authorise or prohibit the online reproduction, in whole or in part, and the making available to the public of its press publications by an information-society-service provider, under new Article 51B of Law 2121/1993.

The right excludes private or non-commercial use by individual users, hyperlinking, and the use of single words or very short extracts whose use does not harm the publisher's investment, and it does not affect the rights of the authors and other rightholders whose works are incorporated in the press publication. The right lasts two years from the first of January following the press publication's publication date.

Publishers owe the journalists who created the incorporated works a share of the annual revenue the publisher earns from information-society-service providers for the use of its press publications, set at 25 percent for a publisher whose enterprise employs fewer than 60 percent of its journalists under a subordinate employment contract, and 15 percent for a publisher above that threshold; this journalist share is non-assignable other than to a collective-management organisation, and a contrary contractual term is void.

Article 21A permits a research organisation or cultural-heritage institution to reproduce a work or other protected subject matter it lawfully accesses for the purpose of text and data mining for scientific research, without a rightholder opt-out, and any contrary contractual term is void.

Article 21B gives anyone else the same reproduction and extraction permission over lawfully accessible works and other material for the purpose of text and data mining, but only where the rightholder has not expressly reserved that use in an appropriate manner, such as machine-readable means for content made publicly available online; copies made under either article may be retained only as long as the mining purpose requires.