Cybersecurity law & regulation in Greece (2026)

Legal framework

Law 5160/2024 (Government Gazette A'/195/27-11-2024) transposing EU NIS2 Directive (2022/2555); supervised by the National Cybersecurity Authority (NCSA / cyber.gov.gr)

NIS2 & cybersecurity law in Greece

In Greece, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Greece implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Greece

1. 01Primary legislation

   Law 5160/2024 (Gov. Gazette A'/195/27-11-2024) transposes NIS2 in full, repealing the prior NIS1 framework. It entered into force on 28 November 2024 and applies to both essential and important entities across sectors including energy, transport, banking, health, digital infrastructure, and public administration.

   digital-strategy.ec.europa.eu ey.com

2. 02National Cybersecurity Requirements Framework

   Ministerial Decision 1689/2025 (6 May 2025) establishes the binding National Cybersecurity Requirements Framework under Law 5160/2024, mandating 22 specific technical and organisational security controls. Entities must also register on the national portal (via Ministerial Decision 1645/2025) and appoint a dedicated security officer.

   zeya.com advisera.com

3. 03Incident reporting obligations

   Under Article 16 of Law 5160/2024 (mirroring NIS2 Article 23), essential and important entities must submit an early warning to the NCSA/CSIRT within 24 hours of becoming aware of a significant incident, a full incident notification within 72 hours, and a final report within one month.

   iclg.com lexology.com

4. 04GDPR personal-data breach notification

   Personal data breaches must be reported to the Hellenic Data Protection Authority (HDPA) within 72 hours under GDPR (Regulation 2016/679), as applied in Greece. Incidents affecting personal data in regulated sectors trigger dual notification to both the NCSA (NIS2 channel) and the HDPA (GDPR channel).

   dpa.gr resourcehub.bakermckenzie.com

5. 05Supervisory authority and penalties

   The NCSA (cyber.gov.gr) is the single competent authority for NIS2 supervision, registration, and sanctions. Fines reach up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% for important entities.

   cyber.gov.gr copla.com

6. 06National Cybersecurity Strategy 2026-2030

   The NCSA published the National Cybersecurity Strategy 2026-2030 in December 2025 (Ministerial Decision No 2563/16-12-2025), structured around five pillars: resilient critical services, modern governance, skills development, EU/international cooperation, and practical solutions, aligning with the ENISA review cycle.

   digital-skills-jobs.europa.eu greekcitytimes.com

NIS2 in Greece: FAQ

Timeline of decisions

1. 1 Feb 2026Enforcement
   Athens Court Convicts Intellexa Founder in 'Predatorgate' Spyware Case

   A Greek misdemeanor court sentenced four individuals, including Intellexa founder Tal Dilian, to eight years each for illegally deploying Predator spyware against politicians, journalists, and senior military officials. It marked Europe's first criminal conviction for commercial spyware abuse, reinforcing regulatory pressure on the surveillance-technology industry.

   Amnesty International

2. 18 Dec 2025Guidance · official
   National Cybersecurity Strategy 2026-2030 Published by NCSA

   The NCSA unveiled Greece's successor five-year strategy organised around five pillars, resilient critical services, modern governance, skills development, EU/international cooperation, and practical solutions, and created a National Cybersecurity Reserve to fund public and private sector resilience initiatives.

   European Commission – Digital Skills & Jobs Platform

3. 6 May 2025Guidance
   JMD 1689/2025: National Cybersecurity Requirements Framework Adopted

   Joint Ministerial Decision 1689/2025 (Government Gazette B' 2186) established mandatory technical and organisational cybersecurity obligations for essential and important entities under Law 5160/2024, covering risk assessments, penetration testing, supply-chain management, encryption, access controls, and mandatory appointment of an Information Security Officer.

   Zepos & Yannopoulos Law Firm

4. 1 Jan 2025Guidance · official
   Ministerial Decision 1645/2025: NIS2 Entity Registration Process Established

   Greece operationalised Law 5160/2024 by defining registration procedures and deadlines for essential and important entities (28 March 2025 for digital-service categories; 11 April 2025 for all others), activating NCSA's supervisory cycle over the expanded NIS2 entity universe.

   European Commission – Digital Strategy

5. 27 Nov 2024Law
   Law 5160/2024: NIS2 Cybersecurity Directive Transposed into Greek Law

   Published in Government Gazette FEK A' 195/27.11.2024, Law 5160/2024 fully transposes Directive (EU) 2022/2555 (NIS2), mandating cybersecurity risk-management measures, mandatory incident reporting, and appointment of a dedicated Security Officer for all essential and important entities. The National Cybersecurity Authority (EAK) is confirmed as the central supervisory and enforcement body, with direct implications for online-infrastructure operators.

   EY Greece (citing Gov. Gazette FEK A' 195/2024)

6. 14 Feb 2024Law · official
   Law 5086/2024: National Cybersecurity Authority (NCSA) Created as Independent Legal Entity

   Published in the Government Gazette (A' 23/14-2-2024), Law 5086/2024 established NCSA as a standalone Legal Entity of Public Law supervised by the Minister of Digital Governance, consolidating cybersecurity strategy-setting, NIS supervision, technical-standard issuance, and national incident coordination under a single dedicated authority.

   NCSA – National Cybersecurity Authority (cyber.gov.gr)

7. 19 Aug 2022Incident
   Ragnar Locker Ransomware Attack on National Gas Operator DESFA

   The Ragnar Locker gang compromised DESFA, Greece's national natural gas system operator, exfiltrating 361 GB of data including engineering designs and financial documents; DESFA refused to pay and disabled most IT systems while maintaining gas supply. The attack highlighted critical-infrastructure vulnerability during the EU energy-security crisis triggered by the war in Ukraine.

   The Record (Recorded Future News)

8. 1 Mar 2022Incident
   'Predatorgate': Predator Spyware Found on Journalist's and Opposition Leader's Phones

   Journalist Thanasis Koukakis and subsequently opposition leader Nikos Androulakis discovered their phones were infected with Predator spyware; ADAE documented over 90 targets. The scandal drove EU parliamentary inquiries, export-control debates, and ultimately judicial and legislative reforms around surveillance and communications privacy.

   Wikipedia – 2022 Greek surveillance scandal

9. 7 Dec 2020Guidance · official
   National Cybersecurity Strategy 2020-2025 Published

   The Ministry of Digital Governance published Greece's first standalone national cybersecurity strategy, setting five strategic goals covering governance, critical infrastructure protection, incident management, research investment, and capacity development, embedded within the Digital Transformation Bible 2020-2025 framework.

   Hellenic Ministry of Digital Governance

10. 1 Dec 2018Law
    Law 4577/2018: NIS1 Directive Transposed, First Binding Sectoral Cybersecurity Obligations

    Greece incorporated EU Directive 2016/1148 (NIS1), establishing a national cybersecurity plan, designating a competent NIS authority within the Ministry of Digital Policy, creating a CSIRT, and imposing incident-reporting and risk-management obligations on operators of essential services and digital service providers.

    CPA Law

11. 1 Jan 2003Law · official
    Law 3115/2003: ADAE Established, Constitutional Watchdog for Communications Privacy

    The Hellenic Authority for Communication Security and Privacy (ADAE) was created under Law 3115/2003, implementing Article 19(2) of the Greek Constitution, as an independent authority to safeguard confidentiality of all communications and oversee lawful interception, forming the institutional backbone of communications-level cybersecurity oversight.

    ADAE – Hellenic Authority for Communication Security and Privacy

Sources

1. 1.digital-strategy.ec.europa.eu/en/policies/nis2-directive-greece
2. 2.cyber.gov.gr/en/
3. 3.ey.com/en_gr/technical/tax/tax-alerts/law-5160-2024-transposition-of-directi
4. 4.zeya.com/newsletters/greece-adopts-national-cybersecurity-requirements-framewo
5. 5.iclg.com/practice-areas/cybersecurity-laws-and-regulations/greece
6. 6.dpa.gr/en/Organisations/Data_Breach_notification
7. 7.digital-skills-jobs.europa.eu/en/actions/national-initiatives/national-strategies/greece-national-c
8. 8.advisera.com/articles/nis2-transposition-greece/
9. 9.lexology.com/library/detail.aspx?g=a0bfd3ea-71a3-4b90-87c0-8f3c8bc4d4ce
10. 10.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/greece/topics/securi
11. 11.copla.com/blog/compliance-regulations/nis2-directive-regulations-and-implementa
12. 12.greekcitytimes.com/2025/12/18/greece-unveils-national-cybersecurity-strategy-2026-2030/