Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Greece applies GDPR through Law 4624/2019, enforced by the Hellenic DPA. Greece was among the earlier EU member states to transpose NIS2, via Law 5160/2024 (in force since November 2024), and by 2026 is in the operational registration and enforcement phase.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Greece without transposition.
SourceGreece's national data protection act, in force since 29 August 2019. Re-establishes the HDPA's role, transposes Directive (EU) 2016/680 alongside GDPR's opening clauses, and sets specific rules for employee, sensitive, health, insurance, and media-sector data.
SourceGreece's NIS2 transposition act, published 27 November 2024, one of the earlier EU transpositions. Complemented in 2025 by secondary legislation on registration and national cybersecurity requirements. Roughly 3,500 organizations fall within scope.
Source72 hours
GDPR Article 33 applies uniformly: notify the HDPA without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: Hellenic Data Protection Authority (HDPA)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceLaw 5160/2024 (NIS2)
Up to €10,000,000 or 2% of total worldwide annual turnover for essential entities, whichever is higher; up to €7,000,000 or 1.4% for important entities. Lower thresholds apply to other infringements and public-sector entities
SourceApplicable , as of 2026-09-08
Fully transposed and in force. Law 5160/2024 was published in the Government Gazette on 27 November 2024. The National Cybersecurity Authority (NCSA) is the competent authority; its entity-registration platform became operational in July 2025, followed by secondary legislation and a National Cybersecurity Strategy 2026-2030. As of mid-2026 the regulatory focus is on scope assessment/registration and supervisory oversight.
SourceHellenic Data Protection Authority(HDPA)
Visit authority siteYes, and has been for some time relative to many EU peers. Greece transposed NIS2 via Law 5160/2024, published 27 November 2024. By 2026 Greece is in the operational/registration phase, with its entity-registration platform live since July 2025.
The Hellenic Data Protection Authority (HDPA), based in Athens, is the national GDPR supervisory authority.
The National Cybersecurity Authority (NCSA), which oversees registration, scope assessment, and incident-reporting compliance for the roughly 3,500 organizations currently identified as in scope.
Talk to us about scoping an engagement around your specific regulatory context.
