Greece

Article 3 of Law 4624/2019 extends the national rules to companies and their suppliers that handle personal data in Greek territory. It also covers handling at a Greek office. And it covers anything else the General Data Protection Regulation reaches. The European rules reach you even if you have no office in Europe. That happens when you offer goods or services to people there, or monitor what they do. European law also requires you to appoint a representative in the European Union if you have no office there. There are narrow exemptions. Greece has not added any Greece-specific representative or registration requirement for foreign companies. The Hellenic Data Protection Authority has claimed authority over foreign companies with no Greek office. Its 20 million euro fine on Clearview AI, a US company with no European presence, is the clearest example.

Industry by industry, checked 18 August 2026. TELECOMS — data must stay in the country Article 6 of Law 3917/2011 is explicit. The retained traffic and location data 'are generated and stored on physical media which are located inside the borders of Greek Territory'. You keep them twelve months. This is a real must-stay-here rule and it has no European equivalent. ONLINE GAMBLING — data must stay in the country Law 4002/2011 requires a licensed online operator to store the relevant records on a physical device located in Greece. That is a server or a 'safe'. You keep them for ten years and must be able to produce them on demand for the regulator and the courts. GOVERNMENT AND PUBLIC SECTOR — data must stay in the country, in effect. Article 87 of Law 4727/2020 required all central public-sector electronic applications to move by 1 January 2022 into one of three state clouds. Those are G-Cloud, run by the General Secretariat for Information Systems. RECloud covers research and education. H-Cloud covers health and is run by the state health IT company. Defence, foreign affairs, the intelligence service, civil protection, the coastguard, the tax authority and academic bodies are exempt. HEALTH — data can leave only if conditions are met We found no general rule forcing private health providers to keep data in Greece, checked 18 August 2026. Public health bodies fall inside the H-Cloud duty above. Medical records must be kept 10 years in private practice and 20 years elsewhere. BANKING, PAYMENTS, INSURANCE, SECURITIES — data can leave only if conditions are met We found no rule forcing data to stay in Greece, checked 18 August 2026. The Bank of Greece requires you to notify it before outsourcing critical or important functions. It does not require approval, and it does not require the data to stay in Greece. The EU financial resilience rules have applied directly since 17 January 2025. They require you to disclose where data is handled, and to keep audit and exit rights. They impose no location rule either. EDUCATION, GAMING (non-gambling), E-COMMERCE, SOCIAL MEDIA, MAPPING — data can leave only if conditions are met We found no Greece-specific rule forcing data to stay in Greece, checked 18 August 2026. Mapping is governed by the copyright and licensing conditions of the Hellenic Military Geographical Service, not by a rule about where data sits. DEFENCE — not researched in depth. Rules on handling classified information are outside what this record covers.

The model is closest to a list of approved countries, with escape routes. The European Commission keeps a well-populated list of approved destinations. Transfers anywhere else need a safeguard. Here is the approved list as at 18 August 2026. Andorra, Argentina, Brazil and Canada, for commercial bodies only. The Faroe Islands, Guernsey, the Isle of Man, Israel, Japan and Jersey. New Zealand, South Korea, Switzerland, the United Kingdom and Uruguay. Also the European Patent Organisation. It also covers the United States, but only for organisations self-certified under the EU-US Data Privacy Framework. Nothing has been withdrawn or suspended. The 2021 Standard Contractual Clauses are still the ones you use. The promised new clauses, for recipients already directly caught by European privacy law, have still not been adopted. Binding Corporate Rules remain available. The narrow exceptions in European law are not a lawful route for routine or bulk transfers. A transfer impact assessment is still expected. The most time-sensitive item is the EU-US Data Privacy Framework. It is still in force and legally valid. But the Latombe appeal is pending before the European Union's top court. On 31 July 2026 the European Data Protection Board formally asked the European Commission to examine whether US developments affect the decision's validity. You can use it today. Never make it your only route. Greece's own contribution is a warning rather than a permission. Passing personal data unlawfully to someone not entitled to it is a crime in Greece, not merely a fine.

The Hellenic Data Protection Authority (Arhi Prostasias Dedomenon Prosopikou Haraktira) is an independent authority written into the constitution. Its published register of acts shows a continuous flow of decisions through 2026. Decision 14 of 15 July 2026 dealt with a university data breach. Decision 8 of 5 June 2026 fined an energy supplier and a bank. Decision 6 of 21 April 2026 dealt with transparency. Its best-known action remains the 20 million euro fine on Clearview AI in July 2022. That was a US company with no European office. The Hellenic Authority for Communication Security and Privacy (ADAE) is a second constitutional authority. It covers the confidentiality of communications. It issued a new binding security regulation for providers in August 2025 (Decision 304/2025). It was still holding hearings in January 2026. The National Cybersecurity Authority runs the network and information security rules and publishes reporting guidance. The Hellenic Telecommunications and Post Commission regulates the telecoms market. The Bank of Greece supervises banks and insurers, including their outsourcing. The Hellenic Gaming Commission licenses and supervises online gambling. Rating: active rather than aggressive. There is steady output and there are real fines. But not the volume or the very large amounts seen in Ireland, France or Spain.

MINIMUMS. Accounting records: five years from the end of the accounting period, or longer where other law requires it (Law 4308/2014, Article 7). Medical records: ten years from the last visit for a private practice, twenty years otherwise (Law 3418/2005, Article 14(4)). Online gambling: ten years, and you must be able to reproduce the data on demand for the supervisory, audit and judicial authorities (Law 4002/2011). Telecoms traffic and location data: twelve months. That is a duty to keep, not a permission (Law 3917/2011, Article 6). MAXIMUMS. The general European rule is that you must not keep personal data longer than you need it. Telecoms retained data must be destroyed automatically once the twelve months expire. Where the data was lawfully accessed, destruction follows within ten days of notification. So here the minimum and the maximum are the same date. That is unusual and easy to get wrong. WHICH WINS. A specific legal duty to keep data is a legal duty under European law. It overrides an individual's request to erase. Greek practice follows this. The awkward cases are backups and log archives. There the specific rule says keep and the general rule says purge.

Clock 1, general privacy. 72 hours from awareness to the Hellenic Data Protection Authority. You must also tell affected individuals without undue delay where the risk to them is high. Clock 2, cybersecurity. Law 5160/2024 brought the European network and information security directive into Greek law. It was published on 27 November 2024. It requires an early warning to the National Cybersecurity Authority 'without undue delay and in any event within twenty-four (24) hours'. Then an incident notification within 72 hours, and a final report within one month. Clock 3, telecoms. Providers of publicly available electronic communications services must notify a personal data breach within 24 hours under Commission Regulation (EU) 611/2013. They must also deal with ADAE where the secrecy of communications is involved. These clocks run in parallel from different starting points. The privacy clock starts at 'awareness'. The cybersecurity clock starts at 'becoming aware of a significant incident'. One event routinely starts all three, and the 24-hour ones start first.

1. AGE FIFTEEN. Article 21(1) of Law 4624/2019 sets the age at which a minor can consent to an information society service at 15. The European default is 16, and other member states range from 13 to 16. A single global age gate set to 16 over-blocks in Greece. One set to 13 is unlawful here. 2. CRIMINAL LIABILITY. Article 38 of Law 4624/2019 makes it a crime to pass personal data to someone not entitled to it. For special categories of data, such as health, biometrics and political opinions, the penalty rises. It becomes imprisonment of at least one year plus a fine of up to 100,000 euros (about 110,000 US dollars). This attaches to individuals, not only to the company. The criminal courts prosecute it, not the privacy regulator. 3. PRINTED BUT UNENFORCEABLE. In Opinion 1/2020 the Hellenic Data Protection Authority concluded that several parts of Law 4624/2019 must not be applied. They are Article 5, Article 6(6)-(8), Articles 22, 24, 25, 26 and Article 27. They do not meet the conditions European rules impose on national law. Those articles are still printed in the statute. A naive reading of the Greek text will produce advice the regulator itself rejects. An example is relying on Article 5 as a standalone legal basis for public-sector work, or on Article 27 for employee data. 4. TELECOMS DATA MUST STAY IN GREECE. Law 3917/2011 requires retained traffic and location data to sit on physical media inside Greek territory. A pan-European telecoms design that centralises this data in one non-Greek data centre breaks Greek law. 5. STATE CLOUD FOR THE PUBLIC SECTOR. Article 87 of Law 4727/2020 obliged public bodies to move their central applications into the Greek state's own clouds by 1 January 2022. If you sell software to Greek ministries, hospitals or universities, your hosting model is decided for you. 6. BONUS, for telecoms and anyone handling interception requests. Law 5002/2022 governs the lifting of communications confidentiality. It was rewritten after the 2022 surveillance scandal. Telling the subscriber is delayed and conditional. A separate constitutional authority polices the rules.

DATED. - 1 October 2026: compulsory business-to-business electronic invoicing extends to all remaining Greek businesses. There is a phase-in window to 31 December 2026. Large businesses, meaning over 1 million euros of 2023 revenue, were originally due on 2 February 2026. The tax authority pushed them to 2 March 2026 on 17 February 2026, with a phase-in to 3 May 2026. - 22 July 2026: Law 5321/2026 was published. It creates Greece's national rules for the European artificial intelligence law. It replaces the relevant parts of Law 4961/2022. It names the competent national authorities. It creates a single registry in which public bodies must record artificial intelligence systems before they go live. It contains transitional rules for public bodies. - 12 January 2027: under the European Data Act, cloud switching charges and data export fees must fall to zero. This is a firm deadline and you cannot contract out of it. THINGS THAT COULD CHANGE WITH NO CONSULTATION. - The Law 3917/2011 rule that telecoms data must stay in Greece could be repealed or narrowed at any time by Parliament. A Greek court applying European case law could also stop applying it overnight. Independent legal analysis published in September 2025 looked at Articles 1, 3, 5 and 6 of that law. It argues they conflict with the European Court's rulings on general and indiscriminate retention. No Greek court has yet stopped applying them, so the duty still binds. But the ground is unstable in both directions. - ADAE can issue new binding security rules for communications providers by decision alone. It did exactly that in August 2025. - The government can extend the state-cloud duty, or narrow the exemptions, by amending Article 87. - The EU-US Data Privacy Framework remains the biggest outside risk. It is valid today. But the Latombe appeal is pending before the European Union's top court. On 31 July 2026 the European Data Protection Board formally asked the Commission to re-examine its validity.