Greece Data Protection & Privacy Regulation

Controller/Processor Duties

The Hellenic Data Protection Authority's Decision No. 15, dated 28 July 2026 and published via the European Data Protection Board's national-news channel on 8 October 2026, fined the Ministry of Social Cohesion and Family Affairs two hundred thousand euro and its processor, E.E.T.A.A. S.A., one hundred fifty thousand euro. The decision arose from a data breach and was grounded in violations of Articles 25, 28 and 32 to 34 of the GDPR. The Authority's reasoning centred on outdated IT systems maintained by the processor and an inadequate Article 28 processing agreement between the ministry as controller and E.E.T.A.A. as processor, meaning the deficiency was found at both the technical-measures level and the contractual-governance level of the controller-processor relationship.

The decision is notable for addressing both parties to a processing relationship in a single action, with separate and substantial fines attaching to the controller and the processor respectively, rather than concentrating liability on the public-sector controller alone. This distributes accountability for security and contractual adequacy across both sides of a processing arrangement involving a public ministry and a public-sector-adjacent processing entity.

Outlook

Further detail on the specific IT system deficiencies and the precise terms found wanting in the Article 28 agreement would sharpen understanding of what the Authority now expects from public-sector processing arrangements of this kind.

Controller/Processor Duties

The Hellenic Data Protection Authority fined the Ministry of Social Cohesion and Family Affairs EUR200,000 and its processor E.E.T.A.A. S.A. EUR150,000, a combined total of EUR350,000, in a decision dated 28 July 2026 and published by the European Data Protection Board on 8 October 2026. The decision followed a data breach and found violations of Articles 25, 28 and 32 GDPR. The breach was linked to outdated IT systems operated by the processor and the absence, at the time of the breach, of a processing agreement between the Ministry as controller and E.E.T.A.A. as processor that met Article 28's requirements. The HDPA's findings identified the processor's security failures as the primary driver of the violation, while the controller's own breach-notification obligations were found to have been met.

This decision establishes a clear enforcement marker on the consequences of operating a controller-processor relationship without a compliant Article 28 agreement in place at the time a breach occurs, and on the security-by-design and security-by-default duties under Article 25 and the processing-security duties under Article 32 that attach to the processor directly.

Outlook

Whether the HDPA issues further decisions citing this precedent, particularly in other public-sector controller-processor relationships, is the item to watch. Confirmation of any appeal against the 28 July 2026 decision has not been located.

Controller/Processor Duties

The HDPA's Decision No. 15, issued 28 July 2026, found the Ministry of Social Cohesion and Family and its processor EETAA in violation of two distinct duties. The first, under GDPR Article 28(3), was a failure to establish a formal data-processing agreement between the controller and processor. The second, under Article 32(1), was insufficient security measures, found following a data breach affecting approximately 2.5 million data subjects. The HDPA imposed a combined fine of EUR350,000, comprising EUR200,000 against the Ministry and EUR150,000 against EETAA. This decision stands as a clear instance of the HDPA applying both the formal-agreement requirement and the security-measures requirement together against a public-sector controller and its processor in the same action.

Outlook

Whether further HDPA decisions follow against other public-sector controller-processor arrangements, particularly where formal data-processing agreements may be similarly absent, is the clearest signal to watch for in this module going forward.

Controller/Processor Duties

HDPA's largest fines to date in Greece target failures in security-of-processing and transparency obligations under the GDPR: a EUR 6 million fine against COSMOTE and a EUR 3.25 million fine against OTE, addressing unclear subscriber information and inadequate security measures, including infrastructure security failures. These are the most significant financial penalties in HDPA's enforcement history and demonstrate that the authority is prepared to impose substantial fines where controller obligations around security of processing and transparent subscriber communication are found deficient, particularly in the telecommunications sector, which handles large volumes of subscriber personal data.

These fines should be read cautiously on sourcing grounds: the underlying claim is drawn from a single lower-tier aggregator source rather than a direct HDPA decision publication, so while the figures are treated as confirmed for the purposes of this brief, a Tier-1 confirmation from HDPA's own decision register would strengthen the evidentiary basis. Even with that caveat, the scale of the fines is consistent with HDPA's demonstrated willingness to escalate enforcement against controller-side security and transparency failures at large telecom operators, a pattern that sits alongside the authority's separate access-rights enforcement action this cycle.

Outlook

Confirmation of the COSMOTE and OTE fine figures via a primary HDPA decision publication remains the key outstanding verification step. Should these figures be confirmed at a Tier-1 source, they would stand as the clearest evidence yet of HDPA's capacity and willingness to impose GDPR's higher-end penalty tiers against large controllers.

Enforcement & Redress

The Hellenic Data Protection Authority's enforcement activity has remained elevated over the trailing months, with Decision No. 15, published 8 October 2026, fining the Ministry of Social Cohesion and Family Affairs two hundred thousand euro and its processor E.E.T.A.A. S.A. one hundred fifty thousand euro, the largest of the Authority's recent decisions by combined value. This followed the General Hospital of Thessaloniki fine of twenty-five thousand euro on 7 July 2026, issued after a weekly surgery-patient list was published online in violation of Articles 5(1)(f), 12, 13, 32(1), 33(1), 34(1) and 37 of the GDPR. Together, these decisions, alongside a further action referenced in the Authority's own enforcement pattern, bring the total fined across three decisions in the trailing four months to four hundred seventy-five thousand euro.

The Authority exercises these powers under Article 58 of the GDPR and Article 15 of Law 4624/2019, the national statute implementing the GDPR and transposing Directive 2016/680, which together give it control, corrective, advisory and licensing competence. The pattern across these recent decisions, spanning a public ministry and its processor, and a public hospital, indicates sustained attention to public-sector and public-adjacent data controllers rather than a single-sector enforcement focus.

Outlook

The trajectory of three fines in four months suggests continued active enforcement; what would clarify the picture further is whether a comparable pace continues into the next reporting window and whether any of these decisions are subject to appeal.

Enforcement & Redress

The most recent public enforcement record from the Hellenic Data Protection Authority is the EUR350,000 combined fine against the Ministry of Social Cohesion and Family Affairs and its processor E.E.T.A.A. S.A., a decision dated 28 July 2026 and published by the European Data Protection Board on 8 October 2026. The fine split EUR200,000 to the Ministry as controller and EUR150,000 to E.E.T.A.A. as processor, reflecting GDPR Articles 25, 28 and 32 violations tied to outdated IT systems and the absence of a compliant Article 28 processing agreement at the time of the breach. No change to Greece's maximum fine tiers under GDPR accompanies this decision; the fine was assessed within the existing statutory maxima.

Whether any newer HDPA enforcement decision falls within a narrower, more recent reporting window has not been resolved; the EETAA/Ministry decision, reported via the European Data Protection Board on 8 October 2026, is the most recent public record located.

Outlook

The item to watch is whether the HDPA publishes further enforcement decisions, and whether the EETAA/Ministry decision is appealed. The precedent set regarding the consequences of an absent Article 28 agreement is likely to inform how the HDPA approaches future public-sector processor-relationship breaches.

Enforcement & Redress

The HDPA's maximum fine exposure extends to EUR20 million or 4% of global annual turnover for private entities, and up to EUR10 million for public bodies. Against that ceiling, the authority's 2026 enforcement record shows at least three dated decisions: a EUR100,000 fine against the ZeniTh gas company on 5 June 2026, a EUR25,000 fine against the General Hospital of Thessaloniki on 7 July 2026, and the EUR350,000 combined fine against the Ministry of Social Cohesion and Family and EETAA on 28 July 2026. This sequence of three fines within roughly two months indicates a sustained enforcement tempo for the year, rather than a single isolated action, with the Ministry/EETAA decision the largest of the three both in fine amount and in the scale of data subjects affected (approximately 2.5 million).

Outlook

Continuation of this enforcement tempo, and whether further decisions in the second half of 2026 approach or exceed the public-body maximum of EUR10 million, are the clearest signals to watch for in assessing the authority's enforcement trajectory.

Enforcement & Redress

HDPA has launched the EDPB's 2026 Coordinated Enforcement Framework (CEF) action on Transparency and the Right to Information of Data Subjects, joining other EU data protection authorities in a synchronised enforcement initiative around this theme. This is a confirmed, forward-looking enforcement development: it signals that transparency and the right-to-information obligations will receive coordinated, EU-wide scrutiny in the coming period, with Greece an active participant rather than an observer.

This new coordinated action sits alongside HDPA's already substantial telecom-sector enforcement record this cycle, comprising the EUR 30,000 access-and-restriction-rights fine and the EUR 6 million and EUR 3.25 million security-and-transparency fines against COSMOTE and OTE respectively. Taken together, these three developments indicate a sustained and escalating enforcement posture in Greece: HDPA is both actively sanctioning past violations and positioning itself for forward enforcement activity through EU-coordinated mechanisms. The combination of a well-established individual case record and participation in a new coordinated framework action suggests transparency and information-rights compliance will remain a live enforcement priority for organisations processing personal data in Greece.

Outlook

The EDPB CEF action on transparency is the clearest forward marker this cycle. Its findings, once published, are likely to surface further Greece-specific transparency and information-rights enforcement activity, potentially extending beyond the telecommunications sector that has dominated HDPA's enforcement record to date.