An international business expanding into Greece often assumes that its existing EU-wide data protection programme will cover every local obligation. In practice, Greek data protection legislation introduces requirements that go beyond the base text of the general European privacy regulation. and the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority. Alternatively. HDPA) has demonstrated a clear willingness to investigate and fine organisations that miss those national layers. The cost of non-compliance – both in regulatory penalties and in reputational terms – substantially exceeds the investment required to build a sound compliance programme from the outset.
Data protection compliance in Greece is governed by the EU's General Data Protection Regulation (GDPR compliance framework) as supplemented by national data protection legislation that addresses specific processing contexts. Every organisation acting as a data controller or data processor with respect to the personal data of individuals in Greece must maintain documented accountability measures. Implement appropriate technical and organisational safeguards, and. There, applicable, appoint a Data Protection Officer. The HDPA serves as the competent supervisory authority and has the power to impose administrative fines, issue corrective orders, and initiate investigations on its own motion.
This guide walks through the procedural requirements step by step, identifies the documents every organisation needs. Highlights the errors most commonly made by foreign businesses entering the Greek market. Additionally, offers a decision checklist to determine which compliance path fits your situation.
The legal regime governing personal data in Greece
Greece implemented the GDPR directly, as it applies in all EU member states. National data protection legislation – enacted to exercise the discretions and obligations left open by the regulation – fills in specific areas that the regulation permits member states to address independently.
Several of those national provisions are practically significant. Greek data protection legislation imposes specific rules on the processing of special categories of personal data, including health information, biometric data, and data revealing religious beliefs or political opinions. The rules on employee monitoring and the handling of personnel records are also subject to national-level requirements that differ in meaningful ways from the approach taken in some other EU jurisdictions.
The HDPA is the Ανεξάρτητη Αρχή (independent supervisory authority) established under Greek law. It operates independently of government, publishes guidance, handles complaints from data subjects, and conducts both reactive and proactive investigations. Its published decisions and opinions offer a practical lens through which to read the formal legal requirements.
A business acting as a data controller determines the purposes and means of processing. A business acting as a data processor processes data on behalf of a controller. Both roles carry distinct obligations. Many international organisations are simultaneously controllers for their own customer data and processors for data belonging to their corporate clients. Mapping this distinction accurately is the starting point for any compliance exercise.
Greek courts – including the Συμβούλιο της Επικρατείας (Council of State, Greece's supreme administrative court) – have addressed data protection questions in the context of administrative reviews of HDPA decisions. Their positions reinforce the authority's approach to proportionality, purpose limitation, and the rights of data subjects. Understanding that judicial backdrop helps organisations assess the realistic risk profile attached to borderline processing activities.
Step-by-step compliance programme: timeline and procedures
Building a defensible compliance programme in Greece follows a defined sequence. Skipping steps or performing them out of order is the most frequent source of documentation gaps identified in HDPA investigations.
Step 1 – Data mapping and asset inventory (weeks one to two). Identify every category of personal data your organisation collects, stores, or shares in connection with Greek operations. Document the source, the purpose, the legal basis for processing, the retention period, and the recipients of each data category. This exercise produces the Αρχείο Δραστηριοτήτων Επεξεργασίας (Record of Processing Activities, or RoPA), which is a mandatory accountability document under data protection legislation for most organisations.
Step 2 – Legal basis assessment (week two to three). For each processing activity, confirm the applicable legal basis. The six legal bases available under the GDPR compliance regime are: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Consent mechanism design deserves particular attention in Greece: the HDPA has taken a strict approach to what constitutes freely given, specific, informed, and unambiguous consent. Pre-ticked boxes, bundled consents, and consent obtained as a condition of service are consistently rejected.
Step 3 – Data processor agreements (weeks two to four). Every relationship in which your organisation engages a third party to process personal data on its behalf must be governed by a written data processing agreement. This includes cloud providers, payroll processors, IT support vendors, and marketing platforms. Agreements must address the subject matter and duration of processing, the nature and purpose of the processing, the type of personal data involved, and the obligations and rights of the controller. Reviewing existing vendor contracts for missing or inadequate data processor clauses is frequently the most time-consuming step for companies entering Greece with established supplier networks.
Step 4 – Privacy notices and internal policies (weeks three to five). Prepare layered privacy notices for each data subject category: customers, website visitors, employees, and contractors. Each notice must be provided at the point of data collection and must identify the controller, the purposes and legal bases of processing, retention periods, data subject rights, and contact details for the DPA. Internal policies – covering data retention, data breach response, subject access requests, and data transfer – must be drafted, approved, and communicated to staff.
Step 5 – Data Protection Officer assessment (weeks three to four). Determine whether your organisation is required to appoint a Data Protection Officer. Under data protection legislation, a DPO is mandatory for public authorities, organisations that carry out large-scale systematic monitoring of individuals, and organisations that process special categories of data on a large scale. Even where appointment is not strictly mandatory, many organisations operating in Greece choose to designate a DPO to strengthen their accountability position before the HDPA.
Step 6 – Data transfer analysis (weeks four to six). If personal data flows outside the European Economic Area – for example, to a US parent company. An Asian technology platform. Alternatively, a service provider in a country without an EU adequacy decision – those transfers require a specific legal mechanism. Standard contractual clauses remain the most widely used instrument. A transfer impact assessment may also be required, particularly where the destination country's public authority access rules create material risks for the transferred data.
Step 7 – Data Protection Impact Assessment for high-risk activities (weeks five to eight). A Εκτίμηση Αντικτύπου (Data Protection Impact Assessment. Alternatively. DPIA) is mandatory before commencing any processing that is likely to result in a high risk to the rights and freedoms of individuals. The HDPA has published a list of processing types that require a DPIA. Common triggers include large-scale profiling, systematic monitoring of publicly accessible areas, processing of special categories of data at scale, and the deployment of new technologies – including AI-based tools.
For businesses exploring AI-driven data processing in Greece, our analysis of AI and technology law in Greece sets out the intersection of data protection obligations and the emerging AI regulatory regime in detail.
Step 8 – Staff training and awareness (ongoing from week four). The HDPA treats staff awareness as an indicator of organisational accountability. Training records, induction materials, and refresher schedules should be documented. Employees who handle personal data as a core part of their role – HR, marketing, IT, and customer service teams – require role-specific training that goes beyond general awareness.
To explore how these steps apply to your specific operational model in Greece, contact us at info@ferrazwhitmore.com for a tailored assessment.
Documentary checklist and cost considerations
A fully compliant organisation in Greece should be able to produce each of the following documents on request from the HDPA:
- Record of Processing Activities (RoPA), maintained and kept current
- Privacy notices for each data subject category
- Data processing agreements with all relevant third-party processors
- Consent records and consent management logs (where consent is the legal basis)
- DPO appointment documentation or a reasoned assessment concluding that appointment is not required
- Data breach register and breach notification records
- DPIAs for all high-risk processing activities
Cost ranges vary considerably depending on organisation size and complexity. Legal advisory fees for a focused compliance review of a small-to-medium business in Greece typically run from several thousand euros upward. Larger organisations with multiple processing activities, cross-border data transfer arrangements, and existing legacy systems should budget materially more. Technology costs – for consent management platforms, data discovery tools, and DPO support software – add a further variable. Government fees and registration costs with the HDPA are generally modest and depend on the type of notification or interaction required.
A common misconception among foreign businesses is that purchasing an off-the-shelf compliance template significantly reduces these costs. Templates can accelerate the documentation phase. However, they do not replace the data mapping exercise, the legal basis assessment. Alternatively. The transfer impact analysis. all of which require engagement with the specific facts of the organisation's operations.
For a comparative perspective on data protection compliance requirements elsewhere in southern Europe, our guide to data protection compliance in Portugal identifies where the Greek and Portuguese national regimes diverge in practice.
Common errors by foreign clients and pitfalls to avoid
The HDPA's published enforcement record reveals consistent patterns among organisations that face investigation. Understanding these patterns is more useful than a generic list of obligations.
Treating another EU compliance programme as sufficient. GDPR compliance achieved in Germany, France, or another member state does not automatically satisfy Greek national requirements. The discretions exercised in Greek data protection legislation – particularly around employment data, health records, and consent mechanisms – differ from those in other jurisdictions. An organisation that relies on its German-law documentation without Greek-specific review is likely to have gaps in precisely the areas the HDPA scrutinises most closely.
Inadequate consent mechanism design. Online businesses frequently implement consent banners that do not meet the HDPA's expectations. Common failures include: consent that is pre-selected; consent that covers multiple purposes in a single checkbox; and consent that is sought after data collection has already begun. The HDPA has issued guidance and fined organisations specifically for defective consent architecture.
Missing data processor agreements with technology vendors. A significant share of investigations triggered by data breaches in Greece reveals that the breached organisation did not have adequate data processing agreements with its cloud or IT provider. Greek data protection legislation is clear: the absence of a written agreement does not suspend the controller's liability – it aggravates it.
Overlooking employee data requirements. Processing employee personal data in Greece is subject to specific conditions under national data protection and employment legislation. Monitoring employee communications, tracking attendance with biometric tools, and processing health-related absence data each require dedicated legal analysis. Foreign employers often import policies designed for their home jurisdiction without adapting them to Greek requirements.
Failing to respond to data subject rights within required timeframes. Requests from individuals to access, rectify, erase, or restrict their personal data must be acknowledged and addressed within one calendar month in most cases. That deadline is non-negotiable under data protection legislation. Organisations without a designated response workflow regularly miss it – and the HDPA treats missed deadlines as evidence of systemic non-compliance rather than isolated error.
Delay in breach notification. A personal data breach that poses a risk to individuals must be reported to the HDPA within 72 hours of the organisation becoming aware of it. Many foreign organisations operating in Greece either do not have an internal breach detection and escalation process, or their process does not identify the Greek HDPA as the competent authority. The 72-hour window is unforgiving; organisations that report late face aggravated penalties.
Our dedicated page on data protection legal services in Greece sets out how Ferraz & Whitmore supports organisations through investigations, breach notifications, and regulatory interactions with the HDPA.
Decision framework: which compliance path suits your scenario
Not every organisation faces the same compliance burden. The following framework helps identify the appropriate level of engagement.
Scenario A – Small foreign business targeting Greek consumers online. You have no physical presence in Greece, but you collect email addresses, process payment data, and use behavioural analytics to serve advertising to Greek residents. Your obligations as a data controller under GDPR compliance rules apply in full. You likely need: a Greek-language privacy notice, a compliant consent mechanism, data processor agreements with your analytics and payment providers, and a designated EU representative if you have no EU establishment. A focused compliance review of four to six weeks is typically sufficient.
Scenario B – Company establishing a Greek subsidiary with local employees. You are establishing an entity in Greece and will hire staff locally. In addition to the standard customer-facing obligations, you must address employee data requirements under Greek employment and data protection legislation. A DPO assessment is necessary. HR policies, monitoring procedures, and employment contracts all require data protection review. Timeline: six to ten weeks for a fully documented programme.
Scenario C – Technology or healthcare business processing sensitive data at scale. You process health data, biometric data, or data relating to vulnerable individuals as a core business function. DPIAs are mandatory. The HDPA may require prior consultation before processing commences. Special category data rules under Greek data protection legislation impose stricter conditions on legal bases, storage, and access controls. This scenario requires the most comprehensive compliance investment and the longest preparation timeline – typically three to six months for a new entrant.
This compliance path is applicable if your organisation meets any of the following conditions:
- You direct goods, services, or communications to individuals in Greece
- You monitor the behaviour of individuals located in Greece
- You employ or engage contractors who are based in Greece
- You transfer personal data collected in Greece to systems outside the EEA
- You use profiling, automated decision-making, or AI tools that process personal data of Greek residents
Before initiating your compliance programme, verify the following:
- Has a complete data mapping exercise been completed for all Greek processing activities?
- Has the legal basis for each processing activity been documented and reviewed under Greek law?
- Are all data processor relationships covered by compliant written agreements?
- Has the DPO appointment requirement been assessed and documented?
- Is there a functioning breach detection and 72-hour notification workflow in place?
Frequently asked questions
Q: How long does it take to achieve data protection compliance in Greece?
A: The timeline depends on the complexity of your data processing activities. A straightforward compliance programme for a small business typically takes four to eight weeks from initial audit to documented readiness. Larger organisations handling sensitive personal data or cross-border data transfer arrangements should allow three to six months. The most time-consuming phase is usually the internal data mapping exercise, which must precede all documentation work.
Q: Does a foreign company with no office in Greece need to comply with Greek data protection rules?
A: Yes, in many cases. If your organisation targets Greek residents, monitors their behaviour online, or offers goods and services to individuals in Greece, the GDPR and Greek data protection legislation apply regardless of where your company is established. Businesses without a local establishment may also be required to appoint a representative in the EU. Failure to do so is a common oversight that attracts supervisory attention from the HDPA.
Q: What is the most common mistake foreign businesses make when entering the Greek market?
A: The most frequent error is treating GDPR compliance from another EU member state as automatically sufficient for Greece. Greek data protection legislation introduces specific national requirements – particularly around special categories of data, employment records, and consent mechanisms – that go beyond the base GDPR text. Engaging a lawyer in Greece with specialist data protection experience is the most reliable way to identify those gaps before the Hellenic Data Protection Authority initiates a review. As a law firm in Greece advising international clients, Ferraz & Whitmore regularly identifies these jurisdiction-specific gaps during initial compliance assessments.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. Our team combines Portuguese civil law expertise with English common law tradition to deliver cross-border legal solutions in data protection compliance, regulatory advisory, and technology law. In Greece, we advise international businesses on GDPR compliance programmes, data controller and data processor obligations, consent mechanism design, cross-border data transfer structures, and interactions with the Hellenic Data Protection Authority. Our data protection practice covers 15 jurisdictions across Europe, supported by practitioners with experience before EU supervisory authorities and in cross-border enforcement matters. The firm's Lisbon base provides direct access to EU regulatory developments, while our common law expertise supports enforcement strategies in English-speaking jurisdictions. To discuss your data protection compliance requirements in Greece, contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.