Data protection — the searches are Greek data protection law, data protection authority Greece, GDPR compliance in Greece, data privacy law or data protection officer — is the set of duties a business has towards the people whose personal data (προσωπικά δεδομένα) it holds: customers, guests, patients, employees, website visitors. In Greece the rules are the EU GDPR, which Greeks write in Latin letters as well (officially ΓΚΠΔ), together with a national law that fills in details, and the regulator is the Hellenic Data Protection Authority, ΑΠΔΠΧ (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), to which anyone can send a complaint (καταγγελία) online. The officer some organisations have to appoint is the υπεύθυνος προστασίας δεδομένων. This page is for businesses; a person who wants their own data removed from a website has a different claim.
Who needs it in Greece
Hosts and managers of short-term rentals, who hold passport data of guests and work through booking platforms; hotels, tour, yacht-charter and diving operators with foreign clients; clinics and dental practices serving medical tourists; online shops, language schools and gyms; employers with staff in Greece; and companies based outside the EU that sell to or track people in Greece.
What a compliance project covers
- An inventory: what data the business holds, where it came from, where it is stored, who sees it and which platforms and suppliers process it.
- The legal basis for each use. Consent (συγκατάθεση) is one of several and is often the wrong one; a contract or a legal duty frequently does the job.
- The documents people see: the privacy notice (πολιτική απορρήτου) in Greek and English, the cookie banner, consent texts, camera signs.
- Agreements with processors — accountant, payroll provider, cloud and booking platforms, marketing agency — and clauses on data in supplier and client contracts.
- Internal procedures: a record of processing, security measures, how to answer a request to access or delete data, and what to do in a data breach (παραβίαση δεδομένων), which may have to be reported to the Authority and to the people affected within the legal deadline.
- Whether a data protection officer is required, and who is the contact for the Authority if not.
Where Greek businesses get caught
- Cameras: video surveillance at a shop, a villa or a hotel follows the Authority's specific guidance on signs, angles and storage.
- Guest data: tourist rentals have reporting duties to the authorities that are separate from the GDPR, and the platform's terms do not replace the host's own compliance.
- Staff: monitoring, biometric time clocks and access to employees' e-mail are frequent subjects of complaints by former employees.
- Complaints: a filed καταγγελία is how many inspections start; fines exist and are not symbolic.
What a lawyer does
Runs the inventory with you, writes the notices and policies in both languages, prepares the processor terms and reviews the data clauses in your contracts (see contract review), advises on the officer question and on cameras and staff data, and represents the business before the Authority when a complaint or a breach arrives. For a company that is being formed, this is part of business set-up rather than something to retrofit.
Questions and answers
Does the GDPR apply to a one-person business or a single rental flat?
Yes, whenever personal data is handled in the course of the business. The size changes how much documentation is expected, not whether the rules apply. For the licence side of a rental, see tourist rental licence application.
Do I need a data protection officer?
Only in the cases the law lists, mainly public bodies and businesses whose core activity is large-scale or sensitive processing. Most small companies do not, but someone still has to be in charge.
Does an NDA with a contractor cover personal data?
Only partly. A non-disclosure agreement protects business information between the parties; personal data follows the GDPR regardless of what the agreement says.
My company is outside the EU. Does this concern me?
It can, when you offer goods or services to people in Greece or monitor their behaviour; a representative in the EU may then be required.