Data protection & NIS2

GDPR and NIS2: what your company actually has to do.

Most Greek businesses process personal data every day, and since Law 5160/2024 many of them also fall under the NIS2 cybersecurity rules. We help you establish which obligations apply to your company, put the necessary documents and procedures in place, and keep them working as the business changes.

Contact the firm Call 24/7 · +30 210 220 5950

Who it is for

Companies that handle customer, employee or supplier data and want their GDPR compliance to reflect how they really operate, and companies that need to know whether NIS2 applies to them.

What we do

The work is based on your own data flows and systems:

01
Mapping of processing activities and the record of processing
02
Privacy notices, consent and cookie arrangements, and employee information
03
Data processing agreements with suppliers, cloud and software providers
04
Impact assessments for processing likely to result in a high risk to individuals, and a breach procedure including notification to the Hellenic Data Protection Authority
05
NIS2 scope assessment, registration and the cybersecurity governance the law requires of management

GDPR obligations that are often missed

Companies with fewer than 250 employees are not automatically exempt from keeping a record of processing. The exemption is lost if the processing is likely to result in a risk to individuals, if it is not occasional, or if it includes special categories of data such as health data, or data on criminal convictions. In practice, regular processing of customer or payroll data is not occasional.

A data protection officer is mandatory where the core activities of the business consist of regular and systematic monitoring of individuals on a large scale, or large-scale processing of special categories of data. Every supplier that processes personal data on your behalf needs a written processor agreement. A personal data breach must be notified to the Hellenic Data Protection Authority, where feasible, within 72 hours of becoming aware of it. In the employment context Law 4624/2019 adds its own rules, including on CCTV at the workplace.

NIS2: who is in scope

Greece transposed the NIS2 Directive (EU) 2022/2555 with Law 5160/2024. As a rule it covers medium and large companies, meaning 50 or more employees, or both annual turnover and annual balance sheet total above €10 million, that operate in the sectors listed in the law. The high-criticality sectors include energy, transport, banking, financial market infrastructures, health, drinking and waste water, digital infrastructure, business-to-business ICT service management, public administration and space. The other critical sectors include postal and courier services, waste management, chemicals, food production and distribution, manufacturing, digital providers and research.

Some entities are in scope whatever their size, such as providers of public electronic communications networks or services, trust service providers, top-level domain registries and DNS service providers. Entities are classed as essential or important, and the supervisory regime differs between the two.

NIS2: what it requires

Entities in scope must register with the National Cybersecurity Authority through the digital platform; the original registration deadline has passed, so a company that has not registered should do so now. Management must approve the cybersecurity risk-management measures and oversee their implementation, its members must follow training, and staff must receive similar training at least once a year. The company must designate an Information and Communication Systems Security Officer, a role that cannot be combined with that of the data protection officer, and keep a single cybersecurity policy.

Significant incidents are reported in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Fines can reach €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, and members of management can be held liable for breaches of these obligations.

FAQ

Questions clients ask

Does GDPR apply to a small business in Greece?

Yes. GDPR applies to any business that processes personal data, whatever its size. Some obligations, such as keeping a record of processing, are relaxed for companies with fewer than 250 employees only when the processing is occasional, low-risk and does not involve special categories of data or criminal-conviction data.

Does my company need a data protection officer?

Only in specific cases: where the core activities consist of large-scale regular and systematic monitoring of individuals, or large-scale processing of special categories of data, and for public bodies. Many SMEs do not need one, but they still need someone responsible for compliance.

How do I know if my company falls under NIS2?

Check two things: whether you operate in one of the sectors listed in Law 5160/2024, and whether you are at least a medium-sized enterprise, meaning 50 or more employees, or both annual turnover and balance sheet total above €10 million. Some providers, such as electronic communications and trust service providers, are covered regardless of size.

Who supervises GDPR and NIS2 in Greece?

GDPR is supervised by the Hellenic Data Protection Authority (dpa.gr). NIS2 is supervised by the National Cybersecurity Authority (cyber.gov.gr), with which entities in scope register through a digital platform.

Can the data protection officer also be our NIS2 security officer?

No. Law 5160/2024 provides that the duties of the Information and Communication Systems Security Officer are incompatible with those of the data protection officer, so the two roles must be held by different people.

How quickly must a cyber incident or a data breach be reported?

A personal data breach goes to the Hellenic Data Protection Authority, where feasible, within 72 hours. A significant NIS2 incident needs an early warning within 24 hours, a notification within 72 hours and a final report within one month. One event can trigger both procedures.

Contact