🇬🇷Law 4624/2019 on Personal Data Protection
Law 4624/2019 on Personal Data Protection
Greece applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.
Status: Current HDPA consolidation with all amendments incorporated, checked 22 August 2026
Citation: Law 4624/2019, especially arts. 21-30
Regulator: Hellenic Data Protection Authority (HDPA)
Source basis: Official HDPA Greek PDF labelled as incorporating all amendments, linked from the Authority's current legal-framework page and checked 22 August 2026.
How the national law fits with GDPR
The Law implements GDPR opening clauses, organises the HDPA and transposes the Law Enforcement Directive, with national rules for children, sensitive and genetic data, employment, expression, research and public bodies.
National additions and variations
- Article 21 sets 15 as the Article 8 age; consent below 15 must be provided by the child's legal representative.
- Article 22 permits specified special-category processing only with appropriate specific safeguards, while Article 23 prohibits genetic-data processing for health and life insurance purposes.
- Article 27 requires employee processing to be strictly necessary, treats consent cautiously, permits collective-agreement rules and limits workplace CCTV to protecting people and property rather than evaluating performance.
- Article 28 balances expression and information against privacy and preserves core GDPR security and processor obligations even where other provisions are disapplied.
- Articles 29 and 30 condition archive, research and statistics derogations and require access controls, pseudonymisation or encryption; research data must be anonymised as soon as the purpose permits.
The local PDF is the Greek consolidated text published by the HDPA. Any English translation is non-controlling and must be checked against the Greek provision and amendment notes.
Operational approach
First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.
Do not treat GDPR compliance as automatic compliance with Law 4624/2019. Record the national trigger, the responsible owner, the local procedure and the current official source reviewed.