GDPR compliance for companies in Greece

Short answer

A company in Greece follows the EU General Data Protection Regulation directly, along with Greek law 4624/2019, under the supervision of the Hellenic Data Protection Authority. In practice, compliance means knowing what personal data the company processes and on what legal basis. It also means informing the people concerned, signing proper contracts with service providers, keeping data secure, and being ready to handle breaches and requests within fixed deadlines. Some companies must also appoint a data protection officer, carry out impact assessments, and follow Greek rules on employee data and workplace CCTV.

Which rules apply and who supervises

The GDPR (Regulation (EU) 2016/679) applies directly in Greece. Law 4624/2019 adds national implementing measures and entrusts supervision of the GDPR in Greece to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), the independent authority originally established under law 2472/1997.

The Greek law makes some national choices that matter to businesses. For example, when an online service is offered directly to a minor and the legal basis is consent, the minor can consent once they have turned 15. Below that age, consent must come from the legal representative. The law also sets specific rules for employee data and workplace CCTV, covered below.

Everything starts from the GDPR principles. Data must be processed lawfully, fairly and transparently. It must be collected for specified, explicit and legitimate purposes, kept to what is necessary, and kept secure. The company must be able to show that it complies.

The core documents and contracts

Record of processing activities (Article 30 GDPR). The exemption for organisations with fewer than 250 employees does not apply if the processing is likely to result in a risk, is not occasional, or includes special categories of data or criminal-conviction data. Since most businesses process customer or staff data regularly, most end up keeping a record.
Privacy notices (Article 13 GDPR). These are given to customers, staff and other people when their data is collected.
Processor contracts (Article 28 GDPR). These are needed with every provider that processes data on the company's behalf, such as payroll, cloud, IT support or marketing providers. A processor may not engage another processor without the company's prior written authorisation.
Security measures (Article 32 GDPR). These are technical and organisational measures matched to the risk.

Data protection officer and impact assessments

Under the GDPR, a data protection officer (DPO) is mandatory for public bodies. It is also mandatory where a company's core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data or criminal-conviction data. EU or Greek law may also require one in other cases. The DPO's contact details must be published and communicated to the Authority. In Greece this is done online through the Authority's portal, using taxisnet credentials.

A data protection impact assessment must be carried out before processing that is likely to result in a high risk. Examples given in the GDPR include systematic and extensive evaluation of people based on automated processing, including profiling, where decisions with legal or similarly significant effects are based on it; large-scale processing of sensitive or criminal-conviction data; and large-scale systematic monitoring of publicly accessible areas. The Hellenic Authority has published a list of processing operations that require an assessment (Decision 65/2018, Government Gazette B' 1622/10-5-2019). The Authority states that the list is not exhaustive.

Employees and workplace CCTV

Under Article 27 of law 4624/2019, employee data may be processed for the employment contract where this is strictly necessary to decide on hiring or to perform the contract. Consent is an exceptional legal basis in employment. If consent is used, it must be given in writing or electronically, separately from the employment contract, and the employee must be told about the right to withdraw it.

CCTV in the workplace is allowed only if it is necessary to protect people and property. The footage may not be used to assess employee performance, and employees must be informed in writing, on paper or electronically. For these rules, 'employees' also includes contractors, job applicants and former staff.

Breaches, requests and fines

Data breach: notify the Authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk. In Greece the notification form is submitted electronically through the Authority's portal; other channels are accepted only exceptionally.
High-risk breach: the people affected must also be told without undue delay, in clear and plain language.
Requests from individuals (access, erasure, objection and the other rights in Articles 15 to 22): reply within one month. This can be extended by two further months for complex or numerous requests, but the person must be told of the extension within the first month.
Fines: up to €10 million or 2% of worldwide annual turnover for some breaches, such as record-keeping, security or DPO obligations. Up to €20 million or 4% for others, such as the basic principles, legal basis and individuals' rights. In each case the higher figure applies.

Questions clients ask

We have fewer than 250 employees. Do we still need a record of processing?

Usually yes. Under the current text the exemption is lost if processing is not occasional, is likely to result in a risk, or involves sensitive or criminal-conviction data. In May 2025 the European Commission proposed widening the exemption to organisations with fewer than 750 employees (COM(2025) 501). Parliament and Council negotiators have since agreed a text, which a Parliament committee approved in July 2026, but the plenary vote is still pending, so the change is not law yet. Check its status before relying on it.

Does every company need a data protection officer?

No. Under the GDPR, a private company must appoint one where its core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of sensitive or criminal-conviction data, or where EU or Greek law requires it. A company may appoint one voluntarily. If it does, the appointment must be notified to the Authority.

How do we know whether a breach must be notified?

Notification is required unless the breach is unlikely to result in a risk to the people concerned. The Hellenic Authority offers a digital assistant on its website for assessing an incident and asks controllers to use it before notifying.

Sources

This page is general information, not legal advice; the answer in any real case depends on its facts and dates.

L+A advises companies in Greece and abroad on data protection, data licensing and AI regulation in Greece.

Send us your question

Tell us about your case. A lawyer of the firm will reply by email.

Your message goes only to the lawyers of the firm and is used only to reply to you. You may write in Greek or English.

What does a company in Greece need to do to comply with the GDPR?