Greece

Fined EUR 2,000 for keeping personal data of a complainant in decisions posted on Diavgeia after her erasure request was refused. The Authority ordered the decisions removed and issued a reprimand for the Art. 17 breach.

Fined as processor for the ministry ΥΚΟΙΣΟ after an attack that succeeded because of outdated information systems and inadequate security measures despite known risks.

The HDPA fined the ministry as controller after a personal data breach at its processor ΕΕΤΑΑ, finding insufficient compliance with Article 28 and security failings. It ordered a processing contract that complies with Article 28 and full implementation of the planned security measures. The ministry was found to have met its breach notification duties.

The Credit and Insurance Committee of the Bank of Greece decided on 20 July 2026 to suspend the institution's authorisation; the announcement is dated 21 July 2026. It gives no decision number or reasons, and its title calls the entity a financial institution while the text calls it a payment institution.

After a ransomware attack that encrypted systems and possibly leaked data of many individuals, the HDPA found that the university had met its notification duties but had gaps in training of privileged users and in network isolation. Under Art. 58(2) it ordered targeted administrator training and completion of planned security measures; no fine is mentioned on the page.

Fined EUR 3,000 for ignoring the HDPA's calls and missing two hearings in a complaint about an alleged unlawful video surveillance system. The Authority reserved its position on the lawfulness of the surveillance itself.

Fined EUR 10,000 for violating the right of access in the same complaint, and reprimanded for failing to ensure the accuracy of data.

Upholding a complaint about uncorrected data on a debt settlement under Law 3869/2010, the HDPA found a breach of the accuracy principle. It ordered the company to build a procedure ensuring its data sources respond correctly and promptly, and to document it within six months; no fine was imposed.

Fined EUR 5,000 in total for not fully satisfying an employee's request for access to footage from the video surveillance system covering the Centre's outdoor area. It also received a reprimand for breach of Art. 24 and an order to supply the requested footage within 15 days of receiving the decision and tell the Authority.

Fined EUR 30,000 after a complaint that the company denied access to recorded phone conversations and breached the right to restriction of processing. It must adopt measures, including more effective training of its representatives, and document them to the HDPA within six months of notification.

The HDPA reprimanded the ministry for not answering a complainant's access request and for answering the Authority's letters about two and four months late. The alleged leak of the complainant's mobile number was dismissed; no fine was imposed.

On a complaint by a fire officer, the HDPA fined the Fire Service Headquarters EUR 10,000 for entering her health data in the common Daily Order and other documents in breach of lawfulness and data minimisation. The reasoning also criticises the unlimited retention rule in PD 210/1992, Art. 20(5), as conflicting with storage limitation. The notice page names the breaches but not the amount; the fine is stated in the operative part of the decision PDF 1_2026.

Fined EUR 5,000 and given a compliance order in the same case on promotional calls made for ZENITH.

Fined EUR 80,000 and ordered to destroy data and comply, in the same case on promotional calls made for ZENITH.

Fined EUR 10,000 with a compliance order and a reprimand after many complaints about promotional calls, some filed after Decision 52/2021, that reached subscribers listed in the Art. 11 register. The decision also fines three call centres that the PDF describes as ZENITH's processors.

Fined EUR 15,000 as the second partner call centre examined in the same case on promotional calls made for the energy provider HERON.

Fined EUR 35,000 as one of two partner call centres examined in the same case on promotional calls made for the energy provider HERON.

Following many complaints about promotional calls, the HDPA fined the energy provider EUR 115,000, finding gaps in its control of partner call centres and in security measures, so that subscribers on the Art. 11 opt-out register were called. The notice page also records a warning and other corrective measures without saying which party they apply to.

After examining 13 complaints and the company's request-handling procedures on its own initiative, the HDPA fined the electricity provider EUR 30,000 for breaching Arts 12(3) and 12(4) in handling access, rectification and erasure requests. It ordered the company to restructure its internal procedures and train staff, with evidence due within six months of notification; call recording itself was held lawful.