Greece data protection law
Law 2472/1997 on the protection of individuals with regard to the processing of personal data, as succeeded by Law 4624/2019 — Hellenic Parliament
Also known as: PIRPPD, Law 2472/1997, Law 4624/2019, Hellenic DPA
At a glance
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Public bodies, and private bodies that process personal data in Greece, through a Greek establishment, or that fall under the GDPR without an EU/EEA establishment. source
- How it is assessed
- Controllers comply themselves under the GDPR and Law 4624/2019; the Authority supervises and can sanction. source
- Authority
- Greek statute law; the Hellenic Data Protection Authority, established by Law 2472/1997 and an independent authority under Article 9A of the Constitution, supervises it. source
- Enforced by
- The Authority applies GDPR fines and can fine public sector bodies up to EUR 10 million; unlawful access to or disclosure of personal data is a crime. source
- Last change
The Greek personal data regime supervised by the Hellenic Data Protection Authority, from the act that first implemented the European data protection directive through to the GDPR implementing law that now carries it.
Recent changes
-
Info
Authority decisions on violations of legitimacy principle in ΔΙΑΥΓΕΙΑ with personal data
The Data Protection Authority issued a decision regarding violations of the principle of legitimacy when publishing individual acts containing personal data on ΔΙΑΥΓΕΙΑ. Public authorities and …
-
Info
Authority imposes fine on company for GDPR violations
The Data Protection Authority imposed a fine on a company for GDPR violations concerning the processing of employee personal data. The company violated the principles of …
-
Info
DPA approves SMS messaging by Ministry of Infrastructure and Transport for road safety
The Hellenic Data Protection Authority (DPA) has issued Decision 17/2026 regarding SMS messaging by the Ministry of Infrastructure and Transport to mobile subscribers for road safety …
That is the last 90 days. Sign in to read further back.
Key dates
No upcoming datesAmendments
-
Law 4624/2019 (as last amended by Law 5221/2025) AmendmentCurrent text
Article 154 of Law 5221/2025 (FEK A' 133/28.07.2025) rewrites Article 18 on the Authority's secretariat: its organisation is approved by decision of the Authority rather than by presidential decree. source
-
Amended by Law 5043/2023 Amendment
Article 123(2) of Law 5043/2023 (FEK A' 91/13.04.2023) repeals Article 11(6) on the liability of the Authority's members and the cost of their legal defence. source
-
Amended by Law 5002/2022 Amendment
Law 5002/2022 (FEK A' 228/09.12.2022) amends the provisions transposing Directive (EU) 2016/680, adds Article 45A, and rewrites Article 84 on which parts of Law 2472/1997 stay in force. source
-
Law 4624/2019 Major version
Law 4624/2019 (FEK A' 137/29.8.2019) sets measures implementing the GDPR, transposes Directive (EU) 2016/680, re-regulates the Authority and repeals Law 2472/1997 save for listed provisions. source
-
—
Law 2472/1997 Major version
The original Greek law on the protection of individuals with regard to the processing of personal data, which established the Hellenic Data Protection Authority. source
Who it applies to
Law 4624/2019 applies to all Greek public bodies and to private bodies with a processing link to Greece, and it sets national GDPR choices such as the age of digital consent.
- Territorial scope
- Public bodies always; private bodies where they process personal data in Greece, in the context of a Greek establishment, or fall under the GDPR without an EU/EEA establishment (Article 3). source
- Children's consent
- For information society services offered directly to a minor, consent is valid from age 15; below 15 it must come from the legal representative (Article 21). source
- Law 2472/1997 remnants
- Law 2472/1997 is repealed except provisions listed in Article 84, including the establishment of the Authority and the sanctions provision used under Law 3471/2006 on electronic communications. source
How compliance is assessed
Controllers comply themselves under the GDPR and Law 4624/2019; the Authority supervises and can sanction.
- Supervision
- The Authority supervises application of the GDPR, Law 4624/2019 and other rules on the protection of individuals in the processing of personal data in Greece (Article 9). source
Enforcement and penalties
The Authority applies GDPR fines and can fine public sector bodies up to EUR 10 million; unlawful access to or disclosure of personal data is a crime.
Up to EUR 10 million
Administrative fine on public sector bodies under Article 39(1). source
Up to 1 year's imprisonment
Unauthorised interference with a personal data filing system that gives knowledge of the data, or unauthorised copying, altering or deleting of data (Article 38(1)). source
At least 1 year and EUR 100,000
Disclosure of unlawfully obtained special category or criminal data: imprisonment of at least one year and a fine of up to EUR 100,000 (Article 38(3)). source
Up to 10 years' imprisonment
Where the offender aimed at unlawful gain or harm and the total gain or damage exceeds EUR 120,000 (Article 38(4)). source
- Public sector fines
- The Authority may fine public sector bodies acting as controllers, except public enterprises and certain organisations, for listed GDPR and national breaches (Article 39(1)). source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Greece data protection law (RSS)