Greece HDPA News (EN)

HDPA Fines Vodafone Greece €30,000 for GDPR Violations

The Hellenic Data Protection Authority (HDPA) issued Decision 2/2026 on 11 February 2026, imposing a fine of €30,000 on Vodafone – PANAFON Anonymous Greek Telecommunications Company for violations of the General Data Protection Regulation (GDPR). The HDPA found that Vodafone violated Articles 12(1)(2)(3)(4), 15, and 18 of the GDPR by: failing to honor a data subject's right of access to recorded conversations, violating the right to restrict processing, creating obstacles during the exercise of access rights, and providing contradictory information about the access request procedure. The HDPA also ordered the company to take appropriate technical and organizational measures to properly and timely examine data subject rights, including enhanced staff training, with supporting documentation to be provided to the HDPA within six months of notification.

Guidelines 1/2026 on Good Legislation for Personal Data Processing

The Hellenic Data Protection Authority (HDPA) published Guidelines 1/2026 on good legislation in relation to personal data processing, dated 10 March 2026. The guidelines require that when a legal rule establishes, permits, or presupposes personal data processing, compliance with specific principles and guarantees derived from EU and national constitutional law is mandatory. The guidelines mandate that drafting bodies consult the HDPA, particularly for high-risk processing, and provide a comprehensive checklist covering processing purpose, legal basis, roles, recipients, data categories, retention periods, data subject rights, security measures, and international transfers.