Do I need a cookie banner if my site only uses essential cookies?

No. Cookies strictly necessary for the service (such as session cookies) do not require consent, but you must still inform visitors about them. All non-essential cookies need prior consent.

Is a cookie wall allowed in Greece?

No. The HDPA's guidance prohibits cookie walls: visitors must be able to use the site without accepting non-essential cookies.

Does my Greek website need a Data Protection Officer?

Not always. Public bodies must appoint one under Greek law 4624/2019, as must organisations whose core activities involve large-scale monitoring or special-category data.

How fast must I report a data breach in Greece?

Within 72 hours of becoming aware of the breach, to the Hellenic Data Protection Authority, and to affected individuals without undue delay when the risk is high.

2026-10-22 · 7 min read · by Greta Rusecke, ISTQB Certified QA Specialist

GDPR Requirements for Websites in Greece: A Practical Checklist

TL;DR Any website that collects personal data — a contact form, analytics, cookies — must follow GDPR. In Greece, the HDPA's Recommendations 1/2020 add specific cookie rules: no cookie walls, an equally prominent Reject button, and no pre-ticked consent boxes.

Does GDPR apply to your website?

If your website processes personal data of visitors — a contact form, newsletter sign-up, analytics, cookies or comment fields — GDPR applies. That is true for a one-person business as much as for a large company, and for websites hosted outside the EU that serve visitors in Greece.

A privacy policy that actually informs

Your privacy policy must state what personal data you collect, why, on what legal basis, how long you keep it, who it is shared with, and how visitors can exercise their rights. It must be easy to find — linked from every page — and specific, not a generic block buried in the terms of use. The HDPA has stressed that a general mention in the terms of service, or a long policy covering unrelated topics, is not enough information for cookie consent.

Cookie consent: the HDPA's specific rules

Beyond GDPR, Greece applies national rules on electronic communications (law 3471/2006). The HDPA's Recommendations 1/2020 set out what a compliant cookie banner looks like:

Prior consent for all non-essential cookies — analytics, statistics and marketing cookies need explicit, active consent.
No cookie walls — visitors must be able to continue using the site without accepting non-essential cookies.
Accept and Reject equally easy — the same number of clicks, from the same layer, with buttons of the same size, emphasis and colour.
No pre-ticked boxes — consent must come from a clear, affirmative action.
Informed consent — continuing to browse after a notice is not consent; explain the specific purpose of each cookie.
Easy withdrawal — users must be able to change their mind as easily as they consented.

The data protection essentials

A lawful basis for every processing activity.
Security: HTTPS everywhere, access control, hashed passwords, regular backups, updated software.
Records of processing activities kept up to date (Article 30).
Written data processing agreements with hosting, email and analytics providers (Article 28).
A Data Protection Officer where required — public bodies must appoint one under Greek law.
A Data Protection Impact Assessment for high-risk processing.
Breach notification within 72 hours to the HDPA, and to affected individuals when the risk is high.

Honouring user rights

Visitors have the right to access their data, correct it, delete it, receive it in a portable format and object to processing. Provide a clear contact channel — your privacy policy should name an email address — and respond within one month.

A website GDPR checklist

Privacy policy published and linked from every page.
Cookie banner with prior consent, equally prominent Accept and Reject, no pre-ticked boxes, no cookie wall.
Consent recorded and easy to withdraw.
HTTPS enabled everywhere.
Data processing agreements in place with all service providers.
Records of processing activities kept up to date.
A named contact for data subject requests, answered within one month.
A breach response procedure with 72-hour notification to the HDPA.

GDPR is part of QA

GDPR compliance is not a one-time project. Every new feature, form or integration that touches personal data needs review, consent flows need testing, and security needs regular verification. Treating privacy and security as part of your quality process — the same way you test functionality — keeps your site compliant and your visitors' data safe.

Frequently asked questions

Do I need a cookie banner if my site only uses essential cookies?: No. Cookies strictly necessary for the service (such as session cookies) do not require consent, but you must still inform visitors about them. All non-essential cookies need prior consent.
Is a cookie wall allowed in Greece?: No. The HDPA's guidance prohibits cookie walls: visitors must be able to use the site without accepting non-essential cookies.
Does my Greek website need a Data Protection Officer?: Not always. Public bodies must appoint one under Greek law 4624/2019, as must organisations whose core activities involve large-scale monitoring or special-category data.
How fast must I report a data breach in Greece?: Within 72 hours of becoming aware of the breach, to the Hellenic Data Protection Authority, and to affected individuals without undue delay when the risk is high.