Data protection & privacy law in Greece (2026)

Legal framework

EU GDPR (Regulation 2016/679) directly applicable + Greek Law 4624/2019 (national supplement, in force 29 August 2019) + Law 3471/2006 (ePrivacy Directive implementation); supervised by the Hellenic Data Protection Authority (HDPA)

GDPR & data protection in Greece

In Greece, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Hellenic Data Protection Authority (HDPA).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Hellenic Data Protection Authority (HDPA)

Applies to

any organisation processing the personal data of people in Greece, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Greece supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Greece

1. 01Primary Legal Framework

   The EU GDPR (Regulation 2016/679) applies directly. Law 4624/2019, in force from 29 August 2019, supplements the GDPR and also implements Directive 2016/680 on law-enforcement data processing. Law 2472/1997 was largely repealed upon GDPR application.

   dpa.gr dpa.gr

2. 02Key National Derogations

   Law 4624/2019 sets the digital consent age at 15 (GDPR default is 16), establishes specific employee data processing rules, and creates sectoral provisions for health, insurance, and media. The HDPA itself raised compatibility concerns with the GDPR in its Opinion 1/2020.

   gdprhub.eu iclg.com

3. 03Supervisory Authority, HDPA

   The Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) is the independent national DPA. It holds full GDPR Article 58 powers: investigations, corrective orders, bans on processing, and administrative fines up to the GDPR statutory maxima.

   dpa.gr dpa.gr

4. 04ePrivacy / Electronic Communications

   Law 3471/2006 transposes the ePrivacy Directive (2002/58/EC) and governs privacy in electronic communications including unsolicited direct marketing (spam/SMS). Violations carry fines up to €150,000 per infringement under this law, enforced by the HDPA.

   dpa.gr edpb.europa.eu

5. 05Recent Enforcement (2024-2025)

   The HDPA fined the Greek Ministry of Interior €400,000 for unsolicited political emails, the National Bank of Greece €200,000 for systematically delayed Article 15 access responses, and Vodafone €350,000 for GDPR Article 28 violations plus €150,000 under Law 3471/2006. The HDPA also opened an ex officio investigation into the DeepSeek AI application.

   gdprhub.eu iclg.com

6. 06EDPB 2026 Coordinated Enforcement

   The HDPA is participating in the EDPB's 2026 Coordinated Enforcement Framework (CEF) action, assessing controllers' compliance with GDPR transparency and right-to-information obligations under Articles 13-14 across 25 EU/EEA supervisory authorities.

   dpa.gr

GDPR in Greece: FAQ

Timeline of decisions

1. 7 Jul 2026Enforcement
   Predatorgate victims sue Intellexa for €1 million each in damages

   Eight individuals whose phones were confirmed infected with Predator spyware filed a civil suit against Intellexa and 13 individuals including founder Tal Dilian, each seeking €1 million for moral harm. The action marks the first major civil damages phase of Greece's multi-year surveillance scandal.

   U.S. News & World Report / Reuters

2. 26 Feb 2026Decision
   Greek court convicts Intellexa founder and three executives over Predator spyware scandal

   An Athens court found Tal Dilian (Intellexa founder), Sara Hamou, Felix Bitzios, and Yiannis Lavranos guilty of breaching telecommunications confidentiality and illegally accessing information systems; each received eight-year suspended sentences. The conviction marked the criminal conclusion of the 2022 Predatorgate affair that had exposed state-linked spyware use against 90+ public figures.

   Citizen Lab

3. 25 Jun 2025Enforcement · official
   HDPA fines Vodafone Greece €350,000 and its data processor €40,000 for data breach

   The Hellenic DPA found Vodafone violated GDPR Articles 5, 28, and 32 by failing to implement adequate technical/organisational measures, inadequately supervising its processor, and providing inaccurate data to prosecutors. The separate processor fine signals HDPA's intent to hold processors directly accountable.

   EDPB

4. 28 Mar 2025Law
   Law 5188/2025: Data Governance Act Supplementary Measures Enacted

   Published in Government Gazette 49/A, Law 5188/2025 established Greece's national implementing measures for the EU Data Governance Act, setting rules for re-using protected public-sector data and registering data intermediary services — creating the data-sharing infrastructure on which AI applications depend.

   EY Greece

5. 1 May 2024Enforcement
   Ministry of Interior fined €400,000 for unlawful disclosure of expatriate voters' personal data

   HDPA penalised the Greek Ministry of Interior for leaking personal data of Greek nationals living abroad that was subsequently used in political email campaigns. The case underscored persistent state-sector compliance failures and the HDPA's willingness to sanction central government ministries.

   DataGuidance

6. 5 Apr 2024Decision
   Council of State Strikes Down Blanket Surveillance Secrecy Provision

   Greece's supreme administrative court ruled a 2021 amendment unconstitutional that barred ADAE from informing citizens about state surveillance on national-security grounds, finding it violated the Greek Constitution, the EU Charter of Fundamental Rights, and the European Convention on Human Rights.

   Human Rights Watch

7. 3 Apr 2023Enforcement
   HDPA issues record public-sector fine of €175,000 over AI border surveillance systems Centaurus and Hyperion

   HDPA found the Ministry of Migration and Asylum used AI-powered surveillance (drones, cameras, sensors) and biometric fingerprint systems in refugee camps without a lawful basis or adequate DPIA, imposing the largest fine ever levied against a Greek public body at that time. The ruling set boundaries on state use of AI at borders.

   EDRi

8. 1 Jul 2022Incident
   Predatorgate surveillance scandal breaks: Predator spyware found targeting 90+ public figures

   PASOK leader Nikos Androulakis disclosed his phone had been targeted by Predator spyware, triggering a national and European Parliament investigation into state-linked surveillance in Greece; HDPA later confirmed 220 malicious SMS messages had infected 92 smartphones. The scandal prompted the resignation of the prime minister's chief of staff and the head of the National Intelligence Service.

   Wikipedia

9. 29 Aug 2019Law · official
   Law 4624/2019 enacted — Greece's national GDPR implementation act

   Signed into force 15 months after GDPR's application date (after an EU infringement referral for late transposition of the Law Enforcement Directive), Law 4624/2019 repealed Law 2472/1997, re-established and expanded the HDPA, supplemented GDPR provisions with national specifics, and transposed Directive 2016/680. Critics noted deviations that created legal uncertainties.

   Hellenic Data Protection Authority

10. 1 Jan 2006Law · official
    Law 3471/2006: e-Privacy Directive Transposed — Electronic Communications Privacy Established

    Law 3471/2006 transposed EU Directive 2002/58/EC (as later amended by 2009/136/EC), creating binding rules on the confidentiality of electronic communications, processing of traffic and location data, data-breach notification for telecoms providers, and a prior-consent requirement for unsolicited commercial communications. It remains Greece's operative e-privacy law for the online sector.

    Hellenic Data Protection Authority (HDPA)

11. 1 Jan 2001Law · official
    Constitutional revision enshrines personal data protection in Article 9A

    Greece's most extensive constitutional revision (affecting 70+ articles) inserted Article 9A, giving every person an explicit constitutional right to protection against electronic collection and processing of personal data, and constitutionally mandating an independent supervisory authority (the HDPA). This elevated data privacy to a fundamental right alongside traditional privacy under Article 9.

    Hellenic Data Protection Authority

12. 1 Jan 1997Law · official
    Law 2472/1997: Greece's First Data Protection Act and Establishment of the HDPA

    Law 2472/1997 transposed EU Directive 95/46/EC, creating the original national data-protection framework and the Hellenic Data Protection Authority (HDPA) as an independent supervisory body with constitutional standing. Although largely superseded by Law 4624/2019, it laid the institutional and legal foundation for all subsequent online privacy, content regulation, and enforcement in Greece.

    Hellenic Data Protection Authority (HDPA)

13. 1 Jan 1997Law · official
    Law 2472/1997 and founding of the Hellenic Data Protection Authority

    Greece's first comprehensive data-protection statute implemented EU Directive 95/46/EC and created the HDPA as an independent public authority with powers to investigate complaints, impose administrative sanctions, and issue guidance. It remained the primary data-protection framework for over 22 years until replaced by Law 4624/2019.

    Hellenic Data Protection Authority

Sources

1. 1.dpa.gr/en/enimerwtiko/legal_framework/personal_data
2. 2.dpa.gr/sites/default/files/2020-08/LAW%204624_2019_EN_TRANSLATED%20BY%20THE%
3. 3.gdprhub.eu/Data_Protection_in_Greece
4. 4.gdprhub.eu/HDPA_(Greece)
5. 5.dpa.gr/en/hdpa/responsibilities_duties_powers
6. 6.iclg.com/practice-areas/data-protection-laws-and-regulations/greece
7. 7.dpa.gr/en/enimerwtiko/press-releases/launch-edpb-2026-coordinated-enforcemen
8. 8.edpb.europa.eu/news/national-news/2025/greek-sa-imposition-fines-telecommunications-
9. 9.dpa.gr/en/enimerwtiko/press-releases/administrative-fines-imposed-telephone-
10. 10.dpa.gr/en/hdpa/mission