· 6 min read · by Greta Rusecke, ISTQB Certified QA Specialist
GDPR in Greece: What It Means and How It Is Enforced
TL;DR GDPR has applied directly in Greece since May 2018, enforced by the Hellenic Data Protection Authority under Greek law 4624/2019. It gives people rights over their data and obliges organisations to protect it — with real fines for those that do not comply.
The short answer
The General Data Protection Regulation (EU) 2016/679 has applied directly in Greece since 25 May 2018. Greek law 4624/2019 adapted national rules to it and re-established the supervisory authority, the Hellenic Data Protection Authority (HDPA). If you process personal data of people in Greece — a name, an email, an IP address, cookie identifiers — GDPR applies to you, no matter where your business is based or how small it is.
Who enforces GDPR in Greece
The Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) is the independent supervisory authority. It investigates complaints, carries out inspections, issues guidance and imposes fines. Anyone can file a complaint with the HDPA — online, free of charge — and the authority publishes its decisions and guidance so organisations can see in practice what compliance looks like.
Your rights under GDPR
GDPR gives individuals concrete rights over their personal data. Organisations must respond to these requests within one month.
- Access — a copy of the personal data held about them.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — the "right to be forgotten" when there is no good reason to keep the data.
- Restriction — limiting how data is used while a dispute is resolved.
- Data portability — receiving data in a portable, machine-readable format.
- Objection — objecting to processing, including for direct marketing.
- Withdrawal of consent — withdrawing consent at any time, as easily as it was given.
What organisations must do
- Identify a lawful basis for every processing activity — consent, contract, legal obligation, legitimate interest.
- Provide clear, specific privacy information before collecting data.
- Apply data protection by design and by default.
- Implement appropriate security measures for the data they hold.
- Keep records of processing activities (Article 30).
- Sign data processing agreements with all processors (Article 28).
- Appoint a Data Protection Officer where required — public bodies must appoint one under Greek law.
- Notify the HDPA of a personal data breach within 72 hours.
Fines and enforcement
GDPR fines reach up to €20 million or 4% of an organisation's total worldwide annual turnover, whichever is higher. The HDPA enforces actively: in 2022 it audited 30 Greek news websites and found that many cookie banners lacked a proper reject option or visually pushed users towards accepting — a breach of the rules on electronic communications.
What this means in practice
Even a simple website with a contact form and analytics collects personal data, so GDPR compliance is a baseline for doing business online in Greece — not an optional extra. The next article walks through the concrete requirements for websites.
Frequently asked questions
- Does GDPR apply to small businesses in Greece?
- Yes. GDPR applies to any organisation processing personal data of people in the EU, regardless of size. Small sites with contact forms, newsletters or analytics are covered.
- Who is the data protection authority in Greece?
- The Hellenic Data Protection Authority (HDPA), an independent authority whose framework was established by Greek law 4624/2019.
- How large are GDPR fines?
- Up to €20 million or 4% of total worldwide annual turnover, whichever is higher, plus possible restrictions on processing.
- How do I file a GDPR complaint in Greece?
- Complaints can be submitted to the HDPA free of charge through its online complaint form; you can also contact the organisation directly first.