Greece

Article 3 designates the Hellenic Data Protection Authority (HDPA) as the market surveillance authority under AI Act Article 70(1) for systems within the Article 5 prohibited practices, the Annex III high-risk list, and the Article 50 transparency duties; Article 4 makes the HDPA the AI Act's single point of contact, and Article 5 names the Hellenic Telecommunications and Post Commission (EETT) as the notifying authority for conformity-assessment bodies.

Article 16 gives the HDPA and other market-surveillance authorities warning, reprimand, and Article 99 fining powers on top of the AI Act's own machinery, plus a periodic financial penalty of up to 2 percent of an undertaking's average daily worldwide turnover for continuing non-compliance.

Article 23 makes it a crime, punished by imprisonment and a fine unless a more severe provision applies, to remove or obstruct the machine-readable marking an AI system embeds in synthetic output under AI Act Article 50(2), or to remove or obstruct a deployer's disclosure under Article 50(4) that content is a deepfake or has been artificially generated or manipulated.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Article 22(1) of Law 4624/2019 allows public and private bodies, by way of derogation from GDPR Article 9(1), to process special categories of personal data where necessary for exercising rights under social security and social protection law and fulfilling the related obligations, or for purposes that include preventive medicine and the assessment of the working capacity of the employee.

Under Article 22(3), all appropriate and specific measures must be taken to safeguard the interests of the data subject in those cases.

A controller must notify the Hellenic Data Protection Authority (HDPA) without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Greece, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Greece's private-sector regime is the General Data Protection Regulation (GDPR) plus Law 4624/2019 (Greek: Nomos 4624/2019), FEK A' 137/29-08-2019, in force from publication on 29 August 2019, which supplies domestic derogations and procedural rules, including an employment article (Article 27) narrowing consent as a lawful basis for employee data processing and separately regulating workplace video surveillance. The Hellenic Data Protection Authority (HDPA) is the supervisory authority.

Article 21(1) of the Law provides that, for information society services offered directly to a minor, processing on the basis of consent is lawful where the minor is at least 15 years old. Article 27(2) of the Law provides that, where an employee's consent is used by way of exception as the legal basis, the employee's dependence under the contract of employment and the circumstances in which consent was given are to be taken into account in deciding whether it was freely given.

Transferring personal data of a person in Greece outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

General Data Protection Regulation (GDPR) Article 22 gives a person in Greece the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Law 4624/2019 adds no rule of its own on automated decisions by a private controller; its automated-decision article (Art. 52) applies only to competent authorities processing for law-enforcement purposes.

General Data Protection Regulation (GDPR) Articles 12 to 21 apply in Greece. Article 27(2) of Law 4624/2019 makes an employee's consent a lawful basis for processing their data only by way of exception, judged mainly by the employee's dependence under the contract of employment and the circumstances in which consent was given.

Article 27(7) permits closed circuit television in the workplace only where necessary for the protection of persons and goods, bars using the data as a criterion for assessing employee performance, and requires the employees to be informed in writing or electronically of its installation and operation.

The Hellenic Data Protection Authority (HDPA) is the supervisory authority. Under Article 39(1) of Law 4624/2019, the Authority can impose on a body of the public sector, with the exceptions that Article 39(1) lists, an administrative fine of up to EUR 10,000,000 for infringements of the General Data Protection Regulation (GDPR) provisions that Article 39(1)(a) and (b) name and of the provisions of the Law that Article 39(1)(c) names.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Article 370B of the Penal Code (370Β in the Greek text) punishes gaining access without right to all or part of an information system, or to electronic data, in breach of a protection measure, with imprisonment of up to two years or a fine. A particularly minor case of that act goes unpunished. Where the act concerns scientific or professional secrets of a public or private enterprise, the punishment is imprisonment of up to three years or a fine.

Article 370C of the Penal Code (370Γ in the Greek text) punishes unlawfully copying, recording, using, disclosing to a third party, or otherwise violating computer data or programs that constitute a state, scientific, professional, or business secret of the public or private sector, with imprisonment of at least three months.

Data also counts as secret where the lawful holder, from a justified interest, treats it as secret, particularly where it has taken measures to keep third parties from learning of it, and paragraph 2 raises the minimum to one year where the offender is in the holder's service or the secret is of especially great economic significance. Under paragraph 3 the acts are prosecuted on a complaint.

Article 370D of the Penal Code (370Δ in the Greek text) punishes without-right copying or use of computer programs with a fine or community service (paragraph 1), and separately punishes without-right access to all or part of an information system, or to data transmitted by telecommunications systems, where the actor violates a prohibition or a security measure the lawful holder has put in place, with imprisonment (paragraph 2).

Where the actor is in the lawful holder's service, paragraph 3 punishes the paragraph-2 act only if an internal regulation, or a written decision of the holder or a competent employee, expressly prohibits it. A neighbouring provision, Article 370E, is a separate offence: unauthorised technical interception of non-public data transmissions or electromagnetic emissions to, from or within an information system, punished with imprisonment of at least three years and a fine.

Article 292B of the Penal Code (292Β in the Greek text) punishes, with imprisonment and a fine, whoever without right seriously hinders or interrupts the operation of an information system by entering, transmitting, deleting, destroying or altering digital data or by blocking access to that data.

Paragraph 2 raises the punishment to imprisonment of at least one year and a fine where the act is committed with a tool designed mainly for attacks affecting a large number of information systems or causing serious damage. It rises to at least two years where the act caused serious damage. It rises to at least three years where the act was committed against information systems forming part of the infrastructure supplying the population with vital goods or services.

Article 292C (292Γ) separately covers producing, selling, obtaining for use, importing, possessing or distributing, without right and in order to commit the Article 292B offenses, devices or computer programs designed or adapted mainly for that purpose, and passwords, access codes or similar data enabling access to an information system.

Article 30(1) applies Chapter Γ' of Part B to Internet of Things devices used by operators of essential services, digital service providers and local government organizations, and excludes devices used by the National Intelligence Service and the Ministry of National Defence and its supervised bodies.

Article 32(1) requires Internet of Things devices to be designed and developed to reach an appropriate level of cybersecurity throughout their life cycle and to prevent unauthorized third parties from altering their use or performance.

Article 32(2) requires devices to incorporate, as use and risk make appropriate, measures such as secure passwords, timely software updates from trusted sources, encryption of critical security data in transit, a public contact point for reporting security incidents, and a policy or procedure for disclosing vulnerabilities or security incidents.

Article 33(1) requires a device intended for supply to Internet of Things operators to be accompanied by the manufacturer's declaration that it complies with the technical security specifications set by ministerial decision under Article 113, paragraph 12α. Article 33(2) requires the declaration to come with instructions for use and security information in terms that end users can easily understand.

Article 33(5) requires a manufacturer that learns a device does not comply with those specifications to inform the importer, the National Cybersecurity Authority and the competent response team immediately. Article 34(1) requires an importer, before supplying a device to Internet of Things operators, to verify that it comes with the declaration of conformity and to make the declaration available to the authority or response team on request.

Article 34(2) requires an importer that learns a device does not comply to stop supplying it until it does, and to inform the manufacturer and, if the device has already been supplied, the authority, the response team and the distributor or operators using it. Article 34(4) applies those importer duties to distributors that supply devices to Internet of Things operators.

Article 35(1) requires Internet of Things operators to use their devices in accordance with the technical security specifications set by that ministerial decision. Article 35(2) requires each operator to appoint an Internet of Things Security Officer to monitor the proper execution of the technical and organizational measures that a further ministerial decision under Article 113, paragraph 12β sets.

Article 35(4) requires an operator whose Security Officer suspects a device presents a risk to inform the authority, the response team, the manufacturer, the importer and the distributor without undue delay and to suspend use of the device to the extent it considers necessary. Article 38(1) requires each operator to keep a register of the devices it uses, update it annually and whenever it commissions a new device, and make it available to the authority or response team on request.

Article 39 requires a manufacturer to have, for each device, a procedure for handling an incident or a vulnerability that a user finds, with documentation of its nature, detailed instructions for dealing with it and mitigation measures. Article 41(2) requires each operator to carry out a data protection impact assessment of the planned processing of personal data related to the operation of the device, in accordance with Article 35(1) of the General Data Protection Regulation.

Article 42 lets the competent organ of the Ministry of Digital Governance, on a reasoned recommendation of the National Cybersecurity Authority, impose on an operator that fails its duties escalating sanctions: a recommendation, a reprimand, a fine of up to EUR 15,000 and, on repetition, a fine of up to EUR 100,000.

Article 113, paragraph 12α, leaves the technical security specifications for devices intended for Internet of Things operators, including the Article 32 measures, to a decision of the Minister of Digital Governance on the recommendation of the National Cybersecurity Authority. Article 116(3), as replaced by Article 28(1) of Law 5256/2025 (Government Gazette A' 223 of 8 December 2025), provides that Chapter Γ' of Part B takes effect on 1 July 2026.

Law 5086/2024 establishes the National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας) as a public-law legal entity, supervised by the Minister of Digital Governance and seated in Athens (Article 3(1)). The Authority's purpose is the organisation, coordination, application and control of an integrated framework of strategies, measures and actions to reach a high level of cybersecurity in the country (Article 4(1)).

Among its tasks it shapes and monitors the framework of technical measures and security requirements for information and communications technology systems (Article 4(2), item η). A reference in legislation to the General Directorate of Cybersecurity of the Ministry of Digital Governance or to the National Cybersecurity Authority means this Authority (Article 3(3)).

Part A takes effect on the publication of the Council of Ministers act appointing the Authority's Governor, and the law states no calendar date for it (Article 40(2)). The Law was published in Government Gazette issue A' 23 on 14 February 2024. The Authority reports that its first Governor was appointed as of April 2024. No publication of the Council of Ministers act appointing the Governor, and so no day on which Part A took effect, has been located.

Article 14 requires the management body of an essential or important entity to approve, within three months of this law's entry into force, the cybersecurity risk-management measures the entity takes to comply with Article 15, to supervise their implementation, and holds the management body responsible for the entity's breach of this duty; its members must undergo training and ensure the entity provides equivalent training to its staff at least annually.

Article 15 requires appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems the entity uses for its activities or to provide its services, and to prevent or minimise the impact of an incident on the recipients of its services or on other services, at a level of security proportionate to the risk, covering at minimum: risk-analysis and information-system security policy; incident handling; business continuity including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of risk-management measures; basic cyber-hygiene practices and cybersecurity training; cryptography and, where relevant, encryption policy; human-resources security, access-control policy and asset management; and the use of multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency-communications systems.

Article 15(5) adds national duties: an essential or important entity designates a qualified ICT Security Officer (Υ.Α.Σ.Π.Ε.) who handles communications with the National Cybersecurity Authority and coordinates compliance internally, keeps a unified cybersecurity policy that an essential entity submits to the Authority for approval at least annually, and keeps a ranked inventory of its information and communication assets.

Article 5, paragraph 3 sets this Law's provisions on risk-management and supervision aside for a financial entity covered by Regulation (EU) 2022/2554, subject to its duty to cooperate with the National Cybersecurity Authority under Article 13. Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity answers under that Regulation instead.

This law, Law 5160/2024 (FEK A' 195/27.11.2024), transposes NIS2 Directive Article 20 (Article 14) and Article 21 (Article 15).

Article 16 requires an essential or important entity to notify, without delay, the computer security incident response team (CSIRT) of the National Cybersecurity Authority of every incident that has a significant impact on the provision of its services (a 'significant incident' under paragraph 3, gated on serious operational disruption or financial loss to the entity, or material harm to other persons).

The notification follows a graduated clock: an early warning within 24 hours of becoming aware of the significant incident, stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects; an incident notification within 72 hours, updating and adding an initial assessment of severity and effects; an interim report if the National Cybersecurity Authority requests one; and a final report no later than one month after the 72-hour notification, covering a detailed description, the type of threat or root cause, mitigating measures, and any cross-border impact, or, for an incident still ongoing at that point, a progress report followed by a final report within one month of its resolution.

A trust-service provider informs the National Cybersecurity Authority of a significant incident affecting its trust services without undue delay and in any case within 24 hours rather than 72. The entity must also, without undue delay, notify service recipients of a significant incident likely to adversely affect the services they receive, and must inform recipients affected by a significant cyber threat of the threat and of measures they can take in response.

Article 5, paragraph 3 sets this Law's provisions on incident-reporting and supervision aside for a financial entity covered by Regulation (EU) 2022/2554, subject to its duty to cooperate with the National Cybersecurity Authority under Article 13. Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity reports under that Regulation instead. This law, Law 5160/2024 (FEK A' 195/27.11.2024), transposes NIS2 Directive Article 23.

Article 11, paragraph 1 of Law 3471/2006 allows the use of automated calling systems, in particular fax machines or electronic mail, and more generally the making of unsolicited communications by any means of electronic communication, for the purposes of direct commercial promotion of products or services and for advertising of every kind, only if the subscriber has first given explicit consent.

Under paragraph 3, electronic mail contact details lawfully obtained in the context of a sale of products or services or another transaction may be used for direct promotion of the supplier's similar products or services, even without prior consent, provided that the recipient is offered a clear and distinct way to object easily and free of charge when the details are collected and in every message.

Paragraph 4 prohibits sending electronic mail for direct commercial promotion that does not clearly state the identity of the sender or of the person for whose benefit it is sent, that has no valid address at which the recipient can ask for the communication to stop, that breaches Article 5 of Presidential Decree 131/2003, or that encourages recipients to visit websites that breach the obligations of the Article. Paragraph 7 applies these rules also to subscribers that are legal persons. Article 172 of Law 4070/2012 replaced paragraphs 3 and 4.

Article 4, paragraph 5 of Law 3471/2006 allows storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user only if that subscriber or user has given consent after clear and comprehensive information. The consent may be given through appropriate settings in the web browser or through another application.

The rule does not prevent technical storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network, or that is necessary to provide an information society service that the user or subscriber has expressly requested. An act of the Data Protection Authority sets out the ways in which the information is given and the consent declared.

Article 4, paragraph 2 of Law 3471/2006 prohibits listening in on, intercepting, storing or any other kind of monitoring or surveillance of electronic communications and the related traffic and location data, unless a law provides otherwise.

Paragraph 3 allows the recording of conversations and the related traffic data when it takes place in the course of lawful professional practice for the purpose of providing evidence of a commercial transaction or of other communication of a professional nature. That recording is allowed on the condition that both parties, after prior information about the purpose of the recording, give their consent.

An act of the Data Protection Authority sets how the parties are informed and give their consent, and how and for how long the recorded conversations and the related traffic data are kept.

Article 11, paragraph 1 of Law 3471/2006 allows the use of automated calling systems for direct commercial promotion of products or services and for advertising of every kind only if the subscriber has first given explicit consent. Paragraph 2 prohibits unsolicited communications with human intervention, meaning calls, for those purposes where the subscriber has declared to the provider of the publicly available service that the subscriber does not wish to receive such calls in general.

The provider must enter those declarations free of charge in a special directory of subscribers that is available to any interested person. Paragraph 7 applies these rules also to subscribers that are legal persons. Law 3917/2011 replaced the first sentence of paragraph 2 from 1 September 2011.

Article 9 of Law 5099/2024 makes the Electronic Crime Prosecution Directorate of the Hellenic Police the law enforcement authority under Article 18 of Regulation (EU) 2022/2065, which receives reports of suspected criminal offences. Article 12 requires the judicial or public authorities that issue an order to act against illegal content to a provider of intermediary services to ensure that the order meets the conditions of Article 9(2) of the Regulation.

Where an order of a public authority does not meet one or more of those conditions, Article 12 treats the order as non-existent for the purposes of the Regulation. The Law entered into force on its publication in the Government Gazette on 5 April 2024.

Article 12 of Law 5172/2025 carries the heading Measures for the removal of certain online material, and cites Article 23 of Directive (EU) 2024/1385.

Article 12(1) lets the competent prosecutor of first instance order, by a fully and specifically reasoned decision, a website manager or hosting provider to remove content that falls under the Penal Code and Law 927/1979 provisions it lists, where the content involves intentional incitement to violence or hatred against a group of persons, or a member of such a group, defined by gender.

The prosecutor serves the order on the website manager or hosting provider, who must comply within 24 hours and send a declaration of compliance. If the manager or hosting provider is unknown or does not comply, the prosecutor issues a new order for internet access providers to cut off access to the domain name or IP address. The National Telecommunications and Postal Commission passes that order to the internet access providers and asks for its immediate application.

Within 24 hours of receiving the order, the internet access providers send the Commission declarations of compliance stating that the measure was carried out and the time access was cut off. The website manager may appeal to the competent judicial council within one month of service of the prosecutor's order. Under Article 98, the Law applies from its publication in the Government Gazette unless a provision says otherwise.

Article 4(1) of Law 5099/2024 names the National Telecommunications and Postal Commission the Digital Services Coordinator under Article 49(2) of Regulation (EU) 2022/2065. Article 5 names the National Council for Radio and Television the competent authority for Article 26(1)(a) to (c), Article 26(2) and Article 28(1) of the Regulation. Article 5 names the Hellenic Data Protection Authority the competent authority for Article 26(1)(d), Article 26(3) and Article 28 of the Regulation.

Article 11(1)(a) requires those asked for information by the Coordinator to provide it without delay, and within 20 working days of the request where the Coordinator sets no deadline. Article 15(1) requires the Coordinator to create and keep an electronic Register of Providers of Intermediary Services within six months of the Law's entry into force.

Article 15(2) requires a provider of intermediary services whose main establishment is in Greece to register within three months of the Register going into operation. Article 15(3) makes registration a declaration by the provider, with no approval act required. Article 15(5) requires a provider to update the Register on any change to the details it holds, without delay and within ten days at the latest.

Article 16(3) caps a fine at six percent of the provider's annual worldwide turnover in the previous financial year. Article 16(3) caps the fine at one percent for inaccurate, incomplete or misleading information, failure to answer or correct it, and failure to submit to an inspection. Article 16(4) caps a periodic penalty payment at five percent of average daily worldwide turnover or income in the previous financial year.

Article 17(1) allows an appeal against a sanction to the Athens Administrative Court of Appeal. Article 17(4) makes an appeal against a fine admissible only on deposit of 15 percent of the fine, and never more than EUR 200,000, with the authority that imposed it.

Article 20(1) lets the Coordinator impose an annual supervisory fee, of a cost-recovery character, on providers of intermediary services that have their main establishment in Greece or a legal representative living or established in Greece, where they have no establishment in the European Union but offer services there. The Law entered into force on its publication in the Government Gazette on 5 April 2024.

Article 1(4) applies the law to every supplier, natural or legal person, of the public and the private sector. Article 1a(5) defines a good as any tangible movable thing. Article 6(1) makes the producer liable for any damage caused by a defect in its product. Article 6(2) treats as the producer the maker of a finished product, of a raw material or of a component, and any person who presents itself as the producer by putting its name, trade mark or another distinguishing mark on the product.

Article 6(2) also treats as products movable things incorporated as components in other movable or immovable things. Article 6(2) also treats as products natural forces, in particular electric current and heat, as long as they are subject to control and confined to a defined space. Article 6(3) makes whoever imports a product for sale, leasing or another form of distribution in the course of its business liable as the producer.

Article 6(4) treats each supplier of the product as the producer where the producer is unknown, unless the supplier tells the consumer within a reasonable time who the producer is or who supplied the product to it. Article 6(4) applies the same rule to the supplier of an imported product where the importer is unknown, even if the producer is known.

Article 6(5) makes a product defective if it does not give the performance provided for by its specifications or the safety reasonably expected in view of all the special circumstances, in particular its external appearance, its expected use and the time it was put into circulation. Article 6(5) provides that a product is not defective only because a better one was put into circulation later. Article 6(6)(a) includes in the damage the damage caused by death or bodily injury.

Article 6(6)(b) includes in the damage harm to or destruction of property of the consumer other than the defective product itself, where the loss exceeds EUR 500 and the property was by its nature intended for, and in fact used by, the injured person for personal use or consumption. Article 6(7) provides for monetary satisfaction for moral harm or mental anguish in the case of a breach of the Article.

Article 6(8)(a) releases the producer on proof that it did not put the product into circulation. Article 6(8)(b) releases the producer on proof that the defect did not exist when the product was put into circulation. Article 6(8)(c) releases the producer on proof that it did not make the product for distribution and did not distribute it in the course of its professional activity.

Article 6(8)(d) releases the producer on proof that the defect is due to the product having been made in accordance with mandatory rules of law. Article 6(8)(e) releases the producer on proof that the state of scientific and technical knowledge when the product was put into circulation did not allow the defect to be discovered.

Article 6(9) also releases the maker of a component on proof that the defect is due to the design of the product into which the component was incorporated or to the instructions given by that product's maker. Article 6(10) makes two or more persons liable for the same damage liable in full toward the injured person, with a right of recourse between them in proportion to each one's part in causing the damage.

Article 6(11) provides that the producer's liability is not reduced where the damage is caused both by a defect and by an act or omission of a third party, unless the injured person or a person for whom it answers is at fault. Article 6(12) makes void any agreement that limits or excludes the producer's liability.

Article 6(13) makes claims against the producer for damage time-barred three years after the injured person learned or should have learned of the damage, the defect and the identity of the producer. Article 6(13) extinguishes the injured person's rights against the producer ten years after the specific product was put into circulation. Ministerial Decision 5338 codified Law 2251/1994 into a single text. The Decision was published in FEK B 40 of 17 January 2018.

Article 67(2) of Law 4488/2017 requires providers of media and communication services, including the internet, to use new technologies, such as talking web pages, subtitling, audio description and sign language interpretation, to ensure the access of persons with disabilities to them. Article 67(2) leaves to a decision of the Minister of Digital Policy, Telecommunications and Media the means, the procedure and any other technical or detailed matter for its application.

Article 67 sits in Part D of Law 4488/2017, which lays down a general framework of rules implementing the United Nations Convention on the Rights of Persons with Disabilities and its Optional Protocol, ratified by Law 4074/2012. Article 72(1) designates the Greek Ombudsman as the framework for promoting the implementation of the Convention. Article 72(2)(b) has the Ombudsman, in that role, handle and investigate reports of violations of the rights of persons with disabilities.

Article 123 starts the force of Law 4488/2017 from its publication in the Government Gazette, unless a provision states otherwise.

Article 10(1) of Law 4779/2021 obliges media service providers to increase continuously and progressively the accessibility of their services to persons with disabilities, achieved in particular through subtitling of programmes, sign language, audio description and spoken subtitling.

Article 2(1) of Law 4779/2021 defines a media service provider as the natural or legal person that has editorial responsibility for the choice of the audiovisual content of the service and determines how it is organised. Article 2(1) of Law 4779/2021 defines a television broadcast as a linear audiovisual media service that the provider supplies for simultaneous viewing of programmes on the basis of a programme schedule.

Article 2(1) of Law 4779/2021 defines an on-demand audiovisual media service as the non-linear service that the provider supplies for viewing programmes at a moment the user chooses, from a catalogue of programmes.

Article 10(2) of Law 4779/2021 requires media service providers to submit to the National Council for Radio and Television (ESR) and to the Media Supervision Directorate of the General Secretariat for Communication and Information, within the first two months of each year, a report on the application of the measures of Article 10(1).

Article 10(3) of Law 4779/2021 requires media service providers to develop plans for the gradual increase of the accessibility of their services to persons with disabilities and to notify them to the ESR and to the Media Supervision Directorate.

Article 10(4) of Law 4779/2021 requires the ESR, in cooperation with other competent authorities or bodies, to give persons with disabilities information on accessibility in the programmes of media service providers and the possibility of filing accessibility complaints through a dedicated website.

Article 10(5) of Law 4779/2021 requires media service providers to give emergency information, including public information and announcements in cases of natural disasters, in a manner accessible and understandable to persons with disabilities. Article 36(1) of Law 4779/2021 provides that the ESR imposes on a media service provider that breaches Article 10(1), (2) or (5) the sanctions that Law 2644/1998 and Law 2328/1995 provide.

Article 26(5) of Law 4994/2022 provides that for a breach of the Act's obligations by media service providers the ESR imposes on the provider the sanctions of Article 36(3) of Law 4779/2021 or of Article 4 of Law 2328/1995.

Article 36(3) of Law 4779/2021 lists a recommendation to comply, a fine from EUR 1,000 to EUR 500,000, temporary suspension of operation from one day to three months and permanent suspension of operation as the sanctions for a video-sharing platform established in Greece that breaches Article 32, chosen according to the gravity of the breach, the degree of fault, the provider's financial situation and recidivism. Article 10 of Law 4779/2021 transposes Article 7 of Directive 2010/13/EU, as amended by Directive (EU) 2018/1808.

Article 3(1) applies the Act to consumer general purpose computer hardware systems and their operating systems, to payment terminals, to automated cash machines, ticketing machines, ticket-checking machines and interactive information self-service terminals that are intended specifically for the provision of services covered by the Act, other than those installed as integral parts of vehicles, aircraft, ships or rolling stock, to consumer terminal equipment with interactive computing capability used for electronic communications services or for access to audiovisual media services, and to e-readers.

Article 5(1) requires all products to meet the accessibility requirements of Sections I and II of Annex I, with self-service terminals excepted as to Section II. Article 7(1) requires manufacturers to ensure that the products they place on the market are designed and manufactured in accordance with the applicable accessibility requirements.

Article 7(2) requires manufacturers to draw up the technical file in accordance with Annex IV, to carry out the conformity assessment procedure of that Annex or have a third party carry it out, and, where conformity is shown, to draw up the EU declaration of conformity and affix the CE marking. Article 7(3) requires manufacturers to keep the technical file and the EU declaration of conformity for five years from the placing of the product on the market.

Article 7(7) requires manufacturers to ensure that the product comes with instructions and safety information in the Greek language, which can be provided in an accessible format on the customer's request.

Article 7(8) requires manufacturers that consider a product they placed on the market non-conforming to take corrective measures at once or withdraw it, to inform the market surveillance authorities of a product that does not meet the accessibility requirements, and to keep a register of non-conforming products and related complaints.

Article 7(9) requires manufacturers to give the market surveillance authority, in Greek and on a reasoned request, all the information and documentation needed to show conformity, and to cooperate with it. Article 8(2) provides that the obligations of Article 7(1) and the drawing up of the technical file cannot be assigned to an authorised representative.

Article 8(2) requires the mandate of an authorised representative to allow at least keeping the EU declaration of conformity and the technical file at the disposal of the surveillance authorities for five years, giving the authority the information and documentation that show conformity, and cooperating with the authority.

Article 9(1) and (2) require importers to place only conforming products on the market and, before doing so, to ensure that the manufacturer has carried out the conformity assessment procedure of Annex IV, has drawn up the technical file, and has met the requirements of Article 7(5) and (6), and that the product bears the CE marking and comes with the required documents.

Article 9(3) provides that an importer that considers a product non-conforming does not place it on the market until it conforms. Article 9(7) requires importers to keep a copy of the EU declaration of conformity at the disposal of the market surveillance authority for five years and to ensure that the technical file can be made available on request.

Article 9(8) requires importers that consider a product they placed on the market non-conforming to take corrective measures at once or withdraw it. Article 10(2) requires distributors, before making a product available, to verify that it bears the CE marking, that it comes with the required documents and with the instructions and safety information in Greek, and that the manufacturer and the importer have met the requirements of Article 7(5) and (6) and Article 9(4).

Article 10(3) provides that a distributor that considers a product non-conforming does not make it available on the market until it conforms. Article 11 treats an importer or distributor as the manufacturer, with the manufacturer's obligations under Article 7, when it places a product on the market under its own name or trademark or modifies a product already on the market in a way that may affect conformity.

Article 12(1) requires the operators of Articles 7 to 10 to identify to the market surveillance authorities each operator that supplied them with a product and each operator they supplied with a product, and Article 12(2) requires them to be able to do so for five years. Article 4(21) defines an economic operator as the manufacturer, the authorised representative, the importer, the distributor or the service provider.

Article 14(1) applies the accessibility requirements of Article 5 to the extent that compliance does not require a significant change resulting in a fundamental alteration of the basic nature of the products or services and does not impose a disproportionate burden on the economic operators concerned. Article 14(2) requires economic operators to make a documented assessment of whether compliance requires a significant change or, on the criteria of Annex VI, imposes a disproportionate burden.

Article 14(3) requires operators to keep all the results for five years from the last placing of a product on the market or the last provision of a service, and to give the authority a copy of the assessment on request. Article 14(4) exempts microenterprises in the products sector from documenting their assessment, but requires them to give the authority, if it asks, the evidence relating to the assessment for the products on which they invoked Article 14(1).

Article 14(6) bars an economic operator of the public or the private sector that receives funding from sources other than its own resources, provided for the purpose of improving accessibility, from invoking point (b) of Article 14(1). Article 14(7) requires an operator that invokes Article 14(1) for a particular product or service to inform the market surveillance authority or the service responsible for checking the compliance of services.

Article 14(7) provides that the duty to inform the authority does not apply to microenterprises. Article 16(1) provides that the EU declaration of conformity states which accessibility requirements fall under the exception when Article 14 is exceptionally used.

Article 15(1) presumes that products and services that comply with harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union meet the accessibility requirements to the extent that the standards cover them.

Article 18(1) and (2) require the CE marking to be affixed visibly, legibly and indelibly to the product or its data plate, or to the packaging and the accompanying documents where the nature of the product does not allow it, before the product is placed on the market.

Article 24 bars an unfavourable discriminatory pricing policy, and any selective financial burden of any kind, against consumers whose access improves or is maximised as a result of the compliance of undertakings and of banking and financial institutions with the Act. Article 26(1) provides that administrative sanctions are imposed on violators of the Act on the basis of the principle of proportionality.

Article 26(3) lets the market surveillance authority, where a product does not conform, take among other administrative measures a recommendation for corrective action, temporary seizure, and a ban on circulation and availability. Article 27(2) leaves to a presidential decree, for products, the cases in which sanctions are imposed, the amount of the administrative fines for each violation, the procedure and bodies that impose them and the procedure for collecting them.

Article 25(2) presumes that a product or service whose characteristics, elements or functions comply with the accessibility requirements of Annex I, in accordance with Section VI of that Annex, meets the accessibility obligations of other Union acts, other than this Act, for those characteristics, elements or functions, unless those acts provide otherwise. Article 7 of Law 4994/2022 transposes Article 7 of Directive (EU) 2019/882.

Article 3(2) applies the Act to electronic communications services other than transmission services used for machine-to-machine services, to services providing access to audiovisual media services, to elements of air, bus, rail and waterborne passenger transport services, to consumer banking services, to e-books and the hardware intended specifically for them, and to e-commerce services.

Article 4(41) defines e-books and dedicated software as the service of providing digital files that convey an electronic version of a book, which can be accessed, navigated, read and used, and the software, including mobile services and applications, dedicated to accessing, navigating, reading and using those files.

The elements of passenger transport services that Article 3(2)(γ) covers are websites, services for mobile devices including mobile applications, electronic tickets and electronic ticketing services, the transmission of information on transport services including real-time travel information (for information screens, only interactive screens located in Greek territory), and interactive self-service terminals located in the European Union.

For urban, suburban and regional transport services, Article 3(2)(γ) applies only sub-item (γε), which covers interactive self-service terminals located in the European Union other than those installed as integral parts of vehicles, aircraft, ships or rolling stock. Article 22(3) applies Chapter H of Law 4727/2020 to services provided through the websites and mobile applications of public sector bodies.

Article 3(4) leaves out of websites and mobile applications pre-recorded time-based media and office file formats published up to 28 June 2025, online maps and mapping services that provide the necessary information in an accessible digital way for navigation, third-party content that the operator neither funds, develops nor controls, and archived content that is not updated or published after 28 June 2025.

Article 5(2) requires all services to meet the accessibility requirements of Sections III and IV of Annex I, except that urban, suburban and regional transport services are excepted as to Section III. Article 5(4) exempts microenterprises that provide services from the accessibility requirements of Article 5(2) and from any obligation relating to compliance with them.

Article 5(3) requires the built environment that the clients of the covered services use to comply with accessibility requirements under the urban planning legislation and the legislation on accessibility in the land zone of ports. Article 26(6) applies the sanctions of the urban planning legislation and of the legislation on accessibility in the land zone of ports to a breach of the built environment obligations of Article 5(3).

Article 6 deems services that comply with the requirements on accessible information and information on accessibility laid down in Regulations (EC) 261/2004, (EC) 1107/2006, (EC) 1371/2007, (EU) 1177/2010 and (EU) 181/2011, and in the related acts issued under Presidential Decree 104/2010, to meet the corresponding requirements of the Act. Where the Act provides additional requirements beyond those of those Regulations and acts, Article 6 applies the additional requirements in full.

Article 13(1) requires service providers to design and provide services in accordance with the accessibility requirements. Article 13(2)(a) requires providers to draw up the information that Annex V requires, to state how the services meet the applicable requirements, to make it available to the public in written and oral form, including in a manner accessible to persons with disabilities, and to keep it for as long as the service is in operation.

Article 13(3) requires providers, subject to Article 28, to ensure that procedures are in place so that the provision of services conforms to the applicable requirements, and to take due account of changes in the service, in the requirements and in the harmonised standards or technical specifications on which conformity is declared.

Article 13(4) requires a provider of a non-conforming service to take the corrective measures needed and to inform the competent market surveillance authority at once, with details of the non-conformity and the measures taken. Article 13(5) requires providers to give the competent authority, on a reasoned request, all the information needed to show that the service conforms, and to cooperate with it.

Article 14(1) applies the accessibility requirements of Article 5 to the extent that compliance does not require a significant change resulting in a fundamental alteration of the basic nature of the products or services and does not impose a disproportionate burden on the economic operators concerned. Article 14(2) requires economic operators to make a documented assessment of whether compliance requires a significant change or, on the criteria of Annex VI, imposes a disproportionate burden.

Article 14(3) requires operators to keep all the results for five years from the last placing of a product on the market or the last provision of a service, and to give the authority a copy of the assessment on request.

Article 14(5) requires service providers that invoke point (b) of Article 14(1) to renew, for at least five years and for each category or type of service, their assessment of whether the burden is disproportionate, when the service offered changes or when the authorities that supervise the compliance of services request it. Article 14(5)(c) of Directive (EU) 2019/882 also requires service providers to renew the assessment in any event at least every five years.

Article 14(6) bars an economic operator of the public or the private sector that receives funding from sources other than its own resources, provided for the purpose of improving accessibility, from invoking point (b) of Article 14(1). Article 14(7) requires an operator that invokes Article 14(1) for a particular product or service to inform the market surveillance authority or the service responsible for checking the compliance of services.

Article 15(1) presumes that products and services that comply with harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union meet the accessibility requirements to the extent that the standards cover them. Article 15(2) presumes that products and services that comply with technical specifications, or parts of them, meet the accessibility requirements to the extent that the specifications cover them.

Article 28(1) lets service providers, until 28 June 2030, keep providing their services with products that they lawfully used to provide similar services before that date. Article 28(1) lets service contracts concluded before 28 June 2025 stay in force without alteration until they expire, for no more than five years from that date.

Article 28(3) lets self-service terminals that service providers lawfully used before 28 June 2025 stay in use for similar services until the end of their economically useful life, for at most twenty years from the start of their use.

Article 24 bars an unfavourable discriminatory pricing policy, and any selective financial burden of any kind, against consumers whose access improves or is maximised as a result of the compliance of undertakings and of banking and financial institutions with the Act. Article 26(4) makes the EETT the competent authority to impose sanctions in the context of electronic communications services, as Article 138 of Law 4727/2020 defines them.

Article 138(3) of Law 4727/2020 lets the EETT impose a fine of up to EUR 3,000,000. Article 26(5) provides that, for a breach of the Act's obligations by media service providers, the National Council for Radio and Television (ESR) imposes on the provider the sanctions of Article 36(3) of Law 4779/2021 or of Article 4 of Law 2328/1995.

The sanctions of Article 36(3) of Law 4779/2021 are a recommendation to comply, a fine from EUR 1,000 to EUR 500,000, temporary suspension of operation for one day to three months, and permanent suspension of operation. Article 3(5) applies the Act without prejudice to Law 4672/2020 on permitted uses of protected works for the benefit of blind, visually impaired and print-disabled persons and to Regulation (EU) 2017/1563.

Article 25(2) presumes that a product or service whose characteristics, elements or functions comply with the accessibility requirements of Annex I, in accordance with Section VI of that Annex, meets the accessibility obligations of other Union acts, other than this Act, for those characteristics, elements or functions, unless those acts provide otherwise. Article 13 of Law 4994/2022 transposes Article 13 of Directive (EU) 2019/882.

Article 23 requires banking and financial institutions and the undertakings that provide banking and financial services to adapt their procedures and documents for the consumer banking services of Article 4(28) so that they fully meet the accessibility requirements of Sections III and IV of Annex I and the functional performance criteria of Section VIII of that Annex. Annex I of Directive (EU) 2019/882 sets the functional performance criteria in its Section VII.

Article 24 bars an unfavourable discriminatory pricing policy, and any selective financial burden of any kind, against consumers whose access improves or is maximised because the undertakings and the banking and financial institutions comply with the Act. Article 4(28) lists as consumer banking services credit agreements, investment services, payment services, services linked to payment accounts and electronic money, each by reference to the Greek law that governs it.

Article 22(2) makes the Hellenic Telecommunications and Post Commission (EETT) the competent authority for monitoring and checking the compliance of electronic communications services, in accordance with Article 113 of Law 4727/2020.

Article 22(1) requires adequate procedures to be established, implemented and regularly updated to check the compliance of services and the Article 14 assessment, to follow up complaints and reports about non-compliance, and to verify that the operator has taken the necessary corrective measures. Article 26(4) makes the EETT the competent authority to impose the sanctions in the electronic communications sector, as Article 138 of Law 4727/2020 defines them.

Article 138(3) of Law 4727/2020 lets the EETT impose one or more of a recommendation, a fine of up to EUR 3,000,000 that is collected under the Public Revenue Collection Code, may include periodic penalties with retroactive effect and may be paid in instalments, and an order to stop or delay a service that would otherwise lead to a serious distortion of competition while compliance with access obligations is pending.

Article 138(5) of Law 4727/2020 lets the EETT, in cases of serious or repeated breaches where the measures of paragraph 3 have no effect, prevent an undertaking from providing electronic communications networks or services or suspend or revoke its rights of use. Article 138(3) of Law 4727/2020 requires a person on whom one of those sanctions is imposed to pay the costs of supervision and spectrum monitoring, where they exist, as the EETT decision defines them.

Article 3(3) applies the Act to the handling of incoming and outgoing emergency communications to and from the single European emergency number 112 after 28 June 2027. Article 13(2)(b) requires service providers to offer the specific accessibility requirements of Section V of Annex I in full, free of charge and without any obligation to use any means of payment, in accordance with Article 217 of Law 4727/2020.

Article 31(3) of Directive (EU) 2019/882 lets Member States apply the measures on the obligations set out in Article 4(8), which concern the answering of emergency communications to 112, at the latest from 28 June 2027.

Article 19(1) applies provisions of Regulation (EU) 2019/1020 on market surveillance to the products of the Act.

Article 19(2) names as market surveillance authority the Directorate for Safety and Compliance of Industrial Products of the General Secretariat for Industry of the Ministry of Development and Investments for computers, operating systems, e-readers, payment terminals and automated cash machines, the Hellenic Telecommunications and Post Commission (EETT) for consumer terminal equipment used for electronic communications services, the General Secretariat for Transport of the Ministry of Infrastructure and Transport together with that Directorate for ticketing machines, ticket-checking machines and interactive information terminals, and the National Council for Radio and Television together with that Directorate for terminal equipment used for access to audiovisual media services.

Article 19(3) provides for inspection teams under the annual regular planning and after a complaint. Article 19(4) requires the surveillance authority, where the operator has invoked Article 14, to check that the assessment was made, to review it and its results and the correct use of the criteria of Annex VI, and to check compliance with the applicable accessibility requirements.

Article 19(5) provides that the information the surveillance authority holds on operators' compliance and on the Article 14 assessment is made available to consumers on request in an accessible format, unless confidentiality prevents it. Article 19(6) requires the surveillance authority to cooperate with the most representative organisation of persons with disabilities.

Article 20(1) requires the surveillance authority, where it has sufficient reason to believe that a product does not conform, to carry out an evaluation, with the operators cooperating fully, and to ask the operator to take all corrective measures within a period it sets, and to require withdrawal from the market only if the operator does not take them in that period.

Article 20(3) requires the operator to ensure that corrective measures are taken for all the products it has placed on the market throughout the European Union. Article 20(4) requires the surveillance authority, if the operator does not take the corrective measures in time, to take all appropriate provisional measures to prohibit or restrict the availability of the product on the market or to withdraw it.

Article 21(1) requires the operator concerned to put an end to formal non-compliance where the CE marking has been affixed in breach of the rules or not affixed, the EU declaration of conformity has not been drawn up or not drawn up correctly, or the technical file is unavailable or incomplete.

Article 21(1) also treats as formal non-compliance missing, incorrect or incomplete identification information under Article 7(6) or Article 9(4) and any other unmet administrative requirement of Article 7 or Article 9. Article 21(2) requires all due measures to restrict or prohibit the availability of the product on the market, or to have it withdrawn, if the formal non-compliance continues.

Article 26(1) provides that administrative sanctions are imposed on violators of the Act on the basis of the principle of proportionality. Article 26(3) lets the market surveillance authority, where a product does not conform, take among other administrative measures a recommendation for corrective action, temporary seizure, and a ban on circulation and availability.

Article 26(2), as amended by Article 69 of Law 5218/2025, takes into account in particular the extent of the non-compliance, the capacity of the economic operator, the size of the enterprise, the circumstances of the breach, the corrective actions and later compliance, and the degree of cooperation with the inspection teams and the competent service.

Article 69 of Law 5218/2025 added to Article 26(2) a second sentence that allows an appeal against the decision imposing sanctions to the body hierarchically superior to the body that imposed the sanction, within thirty days of its notification to the person concerned.

Article 27(2) leaves to a presidential decree, on the proposal of the Ministers of Development and Investments, Finance, Digital Governance, and Infrastructure and Transport, the cases in which sanctions are imposed, the amount of the administrative fines for each violation, the procedure and bodies that impose and collect them, for products.

Article 27(1) leaves to a joint decision of the Ministers of Development and Investments, Finance, Digital Governance, and Infrastructure and Transport, on a proposal of the National Accessibility Authority, the organisation and infrastructure for market surveillance, the administrative procedures for forming mixed inspection teams and the remuneration of the inspectors. Article 26(7) provides that Article 26 does not apply to contract award procedures of Law 4412/2016.

Article 25A, inserted by Article 68 of Law 5218/2025, gives associations of persons under Article 61 of the Civil Code that have a legitimate interest in representing persons with disabilities, and public bodies entrusted with defending the collective interests of persons with disabilities or with ensuring compliance with the Act, the right to bring a collective action.

The collective action can seek that economic operators handling products and service providers refrain from unlawful conduct that breaches the Act, and interim measures to secure the requirements of the Act for that purpose.

Article 25A(2) requires the action to be brought within an exclusive period of eighteen months from when the association or public body learned of the unlawful conduct and in any case within three years of its last occurrence, and lets the court order provisional enforcement of its decision. Article 25A(3) gives exclusive jurisdiction over the action to the Multi-Member Court of First Instance of the defendant's residence or seat.

Article 80(1) of Law 5218/2025 starts its force from publication in the Government Gazette, unless its provisions state otherwise.

Article 54(1) of Law 4412/2016 requires that, for all contracts intended for use by natural persons, whether the general public or the staff of the contracting authority, the technical specifications be drawn up so as to take into account accessibility criteria for persons with disabilities or design for all users.

Where mandatory accessibility requirements have been adopted by a legislative act of the Union, Article 54(1) requires the technical specifications to define the accessibility criteria by reference to those requirements. Article 17 of Law 4782/2021 amended the title and paragraph 9 of Article 54 of Law 4412/2016 and restated the article as a whole.

As restated by Article 17 of Law 4782/2021, Article 54(1) keeps the requirement that the technical specifications of contracts intended for use by natural persons take into account accessibility criteria for persons with disabilities or design for all users. Article 142(3) of Law 4782/2021 starts the force of its remaining articles, those that its paragraphs 1 and 2 do not name, on 1 June 2021.

Article 282(1) of Law 4412/2016 applies the same rule to contracts of contracting entities, with the exception of duly justified cases. Article 379(1) of Law 4412/2016 starts the force of its provisions from their publication, unless a provision states otherwise.

Article 25(1) of Law 4994/2022 makes the accessibility requirements of Annex I, for the products and services that Article 3 covers, mandatory accessibility requirements within the meaning of Article 54(1) and Article 282(1) of Law 4412/2016. Article 28(2) applies the Act in procurement only to award procedures that the contracting authority started, under Articles 61, 120, 290 and 330 of Law 4412/2016, after 28 June 2025.

Article 26(7) provides that Article 26, on administrative sanctions, does not apply to contract award procedures of Law 4412/2016. Article 24(1) of Directive (EU) 2019/882 makes the accessibility requirements of its Annex I mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU.

Article 32 of Law 4779/2021 assigns the National Council for Radio and Television (ESR) to apply AVMSD Article 28b to video-sharing platforms and social networks established in Greece whose video content is functionally separable from the rest of the service.

The duty requires appropriate and feasible measures protecting minors from content that may impair their development, and separately protects the wider public from content inciting violence or hatred or amounting to child pornography, terrorism, xenophobia, or racism offences under EU law. For the protection of minors, the most harmful content is subject to the strictest access-control measures, under Article 32 paragraph 6.

Those measures include, as the case requires, systems that verify the age of platform users, so that minors cannot reach content that may harm their physical, psychological or moral development. They include, as the case requires, parental-control systems for the same purpose.

A covered provider must submit data to ESR annually under Article 32 paragraph 10, covering complaints received and resolved by category, out-of-court settlements, and the parental-control or age-verification systems and media-literacy measures adopted. ESR's competence reaches only providers established in Greece. ESR may impose sanctions for noncompliance under Article 36 of the same Law.

Law 5350/2026 adds Article 4A to Law 5099/2024, which prohibits access to online social-networking services provided by online platforms to minors who have not completed their fifteenth year of age. For that purpose the law says that the age-verification functionality of the digital document repository under Law 4954/2022, or the KidsWallet application, may be used. The law treats 1 January as the date of birth of everyone born in the same calendar year.

Article 5 of the law designates the National Council for Radio and Television and the Hellenic Data Protection Authority as competent authorities. Those authorities are competent to supervise the application of Article 4A and have the powers of paragraph 2 of Article 11. Under Article 6 of the law, its force begins on 1 January 2027. The law applies subject to the adoption of an EU regulation on the same matter, on which it ceases to apply of right.

The Hellenic Parliament voted the law on 23 October 2026. It was published in the Government Gazette on 26 October 2026.

A press publisher established in an EU member state has the exclusive right to authorise or prohibit the online reproduction, in whole or in part, and the making available to the public of its press publications by an information-society-service provider, under new Article 51B of Law 2121/1993.

The right excludes private or non-commercial use by individual users, hyperlinking, and the use of single words or very short extracts whose use does not affect the effectiveness of the publishers' rights, and it does not affect the rights of the authors and other rightholders whose works are incorporated in the press publication. The right lasts two years from the first of January following the press publication's publication date.

Publishers owe the journalists who created the incorporated works a share of the annual revenue the publisher earns from information-society-service providers for the use of its press publications, set at 25 percent for a publisher whose enterprise employs fewer than 60 percent of its journalists under a subordinate employment contract, and 15 percent for a publisher above that threshold; this journalist share is non-assignable other than to a collective-management organisation, and a contrary contractual term is void.

Article 21A permits a research organisation or cultural-heritage institution to reproduce a work or other protected subject matter it lawfully accesses for the purpose of text and data mining for scientific research, without a rightholder opt-out, and any contrary contractual term is void.

Article 21B gives anyone else the same reproduction and extraction permission over lawfully accessible works and other material for the purpose of text and data mining, but only where the rightholder has not expressly reserved that use in an appropriate manner, such as machine-readable means for content made publicly available online; copies made under either article may be retained only as long as the mining purpose requires.