Greece. Comprehensive data protection. Act
Law 4624/2019Law 4624/2019 on the Hellenic Data Protection Authority, implementing measures for the GDPR and transposing Directive (EU) 2016/680
Partly verified
Medium confidence.text_url is the HDPA site; official gazette deep link not verified.
§1Summary
- Synopsis
Greece's Law 4624/2019 implements the GDPR nationally, organises the HDPA and transposes the Law Enforcement Directive. It includes employee CCTV rules, research derogations and criminal sanctions.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 15. HDPA has found several provisions incompatible with the GDPR and declined to apply them; public bodies may be fined up to €10m; criminal offences for unlawful processing.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; public bodies up to €10m
§3Dates
- Key dates
- Adopted
- In force
- Government Gazette ΦΕΚ Α' 137/29.08.2019
§4Text and authority
- Text
- Authoritative text dpa.gr
- Authority
- Hellenic Data Protection Authority (HDPA)
§5Where it applies
- Domestic law of
- Greece
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.text_url is the HDPA site; official gazette deep link not verified.