Greece

Article 3 of Law 4624/2019 extends the national rules to controllers and processors processing personal data in Greek territory, to processing at a Greek establishment, and otherwise where the General Data Protection Regulation applies. Article 3(2) GDPR supplies the extraterritorial hook (offering goods or services, or monitoring behaviour); Article 27 GDPR supplies the EU-representative duty, with the narrow exemptions in Article 27(2). Greece has not legislated any additional Greece-specific representative or registration requirement for foreign controllers. The Hellenic Data Protection Authority has in practice asserted jurisdiction over foreign controllers with no Greek establishment — its EUR 20 million fine on Clearview AI, a US company with no EU presence, is the clearest example.

Sector-by-sector, checked 18 August 2026. TELECOMS — closed Law 3917/2011, Article 6, is explicit: the retained traffic and location data 'are generated and stored on physical media which are located inside the borders of Greek Territory'. Twelve-month retention. This is a genuine localisation mandate and it has no European equivalent. ONLINE GAMBLING — closed Law 4002/2011 requires a licensed online operator to store the relevant records on a physical device located in Greece (a server or a 'safe'), and to keep them for ten years, reproducible on demand for the regulator and the courts. GOVERNMENT AND PUBLIC SECTOR — data must stay in the country in practice. Article 87 of Law 4727/2020 required all central public-sector electronic applications to migrate by 1 January 2022 into one of three state clouds: G-Cloud (run by the General Secretariat for Information Systems), RECloud (research and education) and H-Cloud (health, run by the state health IT company). Defence, foreign affairs, the intelligence service, civil protection, the coastguard, the tax authority and academic bodies are carved out. HEALTH — conditional No general localisation rule found for private health providers, checked 18 August 2026. Public health bodies fall inside the H-Cloud duty above. Medical records must be kept 10 years in private practice and 20 years elsewhere. BANKING, PAYMENTS, INSURANCE, SECURITIES — conditional No localisation rule found, checked 18 August 2026. The Bank of Greece requires prior notification before outsourcing critical or important functions, but does not require approval and does not require the data to stay in Greece. The EU financial resilience rules that apply directly since 17 January 2025 require you to disclose where data is processed and to keep audit and exit rights — but again impose no location rule. EDUCATION, GAMING (non-gambling), E-COMMERCE, SOCIAL MEDIA, MAPPING — conditional No Greece-specific localisation rule found, checked 18 August 2026. Mapping is governed by copyright and licensing conditions of the Hellenic Military Geographical Service rather than by a data-residency rule. DEFENCE — not researched in depth; classified-information handling rules are outside this record's scope.

The model is closest to an allowlist with escape hatches: the European Commission maintains a populated list of approved destinations, and transfers to anywhere else need a safeguard. The approved list as at 18 August 2026 covers Andorra, Argentina, Brazil, Canada (commercial bodies only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, the United States (only for organisations self-certified under the EU-US Data Privacy Framework) and the European Patent Organisation. Nothing has been withdrawn or suspended. The 2021 Standard Contractual Clauses remain the operative set; the promised new clauses for importers already directly caught by the GDPR are still not adopted. Binding Corporate Rules remain available. Article 49 derogations are narrow and are not a lawful route for routine or bulk transfers. A transfer impact assessment is still expected. The single most time-sensitive item is the EU-US Data Privacy Framework: still in force and legally valid, but the Latombe appeal is pending before the EU's top court, and on 31 July 2026 the European Data Protection Board formally asked the European Commission to examine whether US developments affect the decision's validity. Usable today; never as your only mechanism. Greece's own contribution is a warning rather than a permission: unlawfully passing personal data to someone not entitled to it is a criminal offence in Greece, not merely a fine.

The Hellenic Data Protection Authority (Arhi Prostasias Dedomenon Prosopikou Haraktira) is a constitutionally entrenched independent authority. Its published register of acts shows a continuous flow of decisions through 2026 — decision 14 of 15 July 2026 on a university data breach, decision 8 of 5 June 2026 imposing fines on an energy supplier and a bank, decision 6 of 21 April 2026 on transparency. Its best-known action remains the EUR 20 million fine on Clearview AI in July 2022, imposed on a US company with no European establishment. The Hellenic Authority for Communication Security and Privacy (ADAE) is a second constitutional authority, covering the confidentiality of communications; it issued a new binding security regulation for providers in August 2025 (Decision 304/2025) and was still convening hearings in January 2026. The National Cybersecurity Authority runs the network-and-information-security regime and publishes reporting guidance. The Hellenic Telecommunications and Post Commission regulates the telecoms market. The Bank of Greece supervises banks and insurers, including their outsourcing. The Hellenic Gaming Commission licenses and supervises online gambling. Rating: active rather than aggressive — steady output and real fines, but not the volume or the headline values seen in Ireland, France or Spain.

FLOORS. Accounting records: five years from the end of the accounting period, or longer where other law requires it (Law 4308/2014, Article 7). Medical records: ten years from the last visit for a private practice, twenty years otherwise (Law 3418/2005, Article 14(4)). Online gambling: ten years, with the data reproducible on demand for the supervisory, audit and judicial authorities (Law 4002/2011). Telecoms traffic and location data: twelve months, and this is a duty to retain, not a permission (Law 3917/2011, Article 6). CEILINGS. The general storage-limitation principle in Article 5(1)(e) GDPR. Telecoms retained data must be destroyed automatically once the twelve months expire, and within ten days of notification where the data was lawfully accessed — so here the floor and the ceiling are the same date, which is unusual and easy to get wrong. CONFLICT RULE. A specific statutory retention duty is a legal obligation under Article 6(1)(c) GDPR and therefore overrides an individual's erasure request under Article 17(3)(b). Greek practice follows this. The awkward cases are backups and log archives, where the specific rule says keep and the general rule says purge.

Clock 1 — general privacy: 72 hours from awareness to the Hellenic Data Protection Authority under Article 33 GDPR, plus notification to affected individuals without undue delay under Article 34 where the risk is high. Clock 2 — cybersecurity: Law 5160/2024, which transposed the EU network-and-information-security directive and was published on 27 November 2024, requires an early warning to the National Cybersecurity Authority 'without undue delay and in any event within twenty-four (24) hours', an incident notification within 72 hours, and a final report within one month. Clock 3 — telecoms: providers of publicly available electronic communications services must notify a personal data breach within 24 hours under Commission Regulation (EU) 611/2013, and must additionally deal with ADAE where the secrecy of communications is engaged. These clocks run in parallel from different trigger points — 'awareness' for the privacy clock, 'becoming aware of a significant incident' for the cybersecurity clock. One event routinely starts all three, and the 24-hour ones start first.

1. AGE FIFTEEN. Article 21(1) of Law 4624/2019 sets the age at which a minor can consent to an information society service at 15. The European default is 16, and other member states range from 13 to 16. A single global age gate set to 16 over-blocks in Greece; one set to 13 is unlawful here. 2. CRIMINAL LIABILITY. Article 38 of Law 4624/2019 makes it a criminal offence to transmit or make personal data available to someone not entitled to it. For special categories of data — health, biometrics, political opinions and the like — the penalty rises to imprisonment of at least one year plus a fine of up to EUR 100,000 (about $110,000). This attaches to individuals, not only to the company, and it is prosecuted by the criminal courts, not the privacy regulator. 3. PRINTED BUT UNENFORCEABLE. In Opinion 1/2020 the Hellenic Data Protection Authority concluded that Article 5, Article 6(6)-(8), Articles 22, 24, 25, 26 and Article 27 of Law 4624/2019 do not meet the conditions the European rules impose on national law and must not be applied. Those provisions are still printed in the statute. A naive reading of the Greek text — for example relying on Article 5 as a standalone legal basis for public-sector processing, or on Article 27 for employee data — will produce advice the regulator itself rejects. 4. TELECOMS LOCALISATION. Law 3917/2011 requires retained traffic and location data to sit on physical media inside Greek territory. A pan-European telecoms architecture that centralises metadata in one non-Greek data centre breaks Greek law. 5. STATE CLOUD FOR THE PUBLIC SECTOR. Article 87 of Law 4727/2020 obliged public bodies to move their central applications into the Greek state's own clouds by 1 January 2022. If you sell software to Greek ministries, hospitals or universities, your hosting model is decided for you. 6. Bonus, for telecoms and anyone handling interception requests: Law 5002/2022 governs the lifting of communications confidentiality and was rewritten after the 2022 surveillance scandal. Subscriber notification is delayed and conditional, and the rules are policed by a separate constitutional authority.

DATED. - 1 October 2026: mandatory business-to-business electronic invoicing extends to all remaining Greek businesses, with a phase-in window to 31 December 2026. Large businesses (over EUR 1 million of 2023 revenue) were originally due on 2 February 2026 and were pushed to 2 March 2026 by the tax authority on 17 February 2026, with a phase-in to 3 May 2026. - 22 July 2026: Law 5321/2026 published, creating Greece's national framework for the European artificial intelligence rules. It replaces the relevant provisions of Law 4961/2022, names the competent national authorities, and creates a single registry in which public bodies must record artificial intelligence systems before they go live. It contains transitional provisions for public bodies. - 12 January 2027: under the European Data Act, cloud switching charges and data egress fees must fall to zero. This is a hard deadline and it is not negotiable by contract. DORMANT SWITCHES — powers already held that could change the picture with no consultation. - Law 3917/2011 telecoms localisation could be repealed or narrowed at any time by Parliament, and could equally be disapplied overnight by a Greek court applying EU case law. Independent legal analysis published in September 2025 argues Articles 1, 3, 5 and 6 of that law are contrary to the EU Court's rulings on general and indiscriminate retention. No Greek court has yet disapplied them, so the localisation duty still binds — but the ground is unstable in both directions. - ADAE can issue new binding security regulations for communications providers by decision alone; it did exactly that in August 2025. - The government can extend the state-cloud obligation, or narrow the carve-outs, by amending Article 87. - The EU-US Data Privacy Framework remains the biggest external switch. It is valid today, but the Latombe appeal is pending before the EU's top court and the European Data Protection Board formally asked the Commission on 31 July 2026 to re-examine its validity.