Greece

GR · GRC · Europe

6 regulators · 13 laws & regulations · 5 obligations · 19 enforcement actions

Obligation	Timing	Regulator	Arises from	Source
All industries
Incident notification to the National Cybersecurity Authority (NIS2)	Deadline Early warning 24 hours; update 72 hours; final report 1 month	NCSA	Law 5160/2024 (Government Gazette A 195/27.11.2024) — Transposition of Directive (EU) 2022/2555 (NIS 2) on measures for a high common level of cybersecurity across the Union, and other provisions	official
Article 16 of Law 5160/2024 imposes stages of notification on essential and important entities: an early warning within 24 hours, a fuller update within 72 hours, an intermediate report on request and a final report within one month. Notices go to the NCSA CSIRT; central government and first- and second-tier local government notify the CSIRT of the National Intelligence Service with a copy to the NCSA.
Personal data breach notification to the HDPA	Deadline Within 72 hours where feasible	HDPA	Law 4624/2019 (Government Gazette A 137, 29.08.2019) — measures implementing the GDPR, transposing Directive (EU) 2016/680, and other provisions	official
The HDPA states that controllers must notify it without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to risk individuals' rights and freedoms, using its online form, and must record every breach internally. Where the risk is high, individuals must also be informed.
Banking
Major ICT incident reporting and ICT third-party register (DORA)	Deadline Deadlines per RTS (EU) 2025/301	Bank of Greece	Regulation (EU) 2022/2554 (DORA), as applied by the Bank of Greece	official
Supervised institutions send completed major-incident templates through a secure channel to the Bank of Greece, with notification deadlines set by RTS (EU) 2025/301 and forms by ITS (EU) 2025/302. Under Chapter V they must keep a register of information on contractual arrangements with ICT third-party providers and report it regularly.
Payments & Fintech
Authorisation of payment and e-money institutions	Deadline Before starting activity	Bank of Greece	Executive Committee Act 164/2/13.12.2019 — authorisation of payment and e-money institutions	official
Executive Committee Act 164/2/13.12.2019 sets the conditions for authorising payment and e-money institutions, including qualifying holdings, board positions and minimum professional indemnity insurance or comparable guarantees. Chapter I section 7 and Chapter III section 7 set measures for safeguarding the funds of payment service users and e-money holders.
Telecom & Tech
Periodic conformity assessment audit of qualified trust service providers	Frequency At least every 24 months	EETT	—	official
Art. 9 of EETT Regulation 837/1B provides for conformity assessment body audits of qualified trust service providers at least every 24 months, with the content of the report set by Art. 10. EETT's trust services page adds that the audit is at the provider's own expense and that the reports go to EETT for approval.
No obligations match these filters.