Meet Greece's Law 4624/2019 data protection rules with less effort

Law 4624/2019 is Greece's national data protection law. It supplements the EU GDPR by setting out the powers of the Hellenic Data Protection Authority, using the GDPR's room for national rules on topics such as children's consent, employee data, CCTV at work and research, and transposing the Law Enforcement Directive (EU) 2016/680. It was published in the Government Gazette (A' 137) on 29 August 2019.

Any public or private body that processes personal data in Greece must comply with Law 4624/2019 alongside the GDPR. In practice that covers Greek companies, public authorities and foreign organisations with an establishment or employees in Greece. Chapter D applies only to competent authorities processing data for criminal law enforcement, while Chapters A to C apply to businesses and public bodies generally.

Law 4624/2019 does not replace the GDPR, which applies directly in Greece. Instead it adds Greek rules where the GDPR allows member states to legislate, for example setting the age of digital consent at 15, regulating employee data and CCTV in Article 27, and limiting some data subject rights. The Hellenic DPA has said it will not apply provisions it considers incompatible with the GDPR.

Private organisations face GDPR fines imposed by the Hellenic DPA under Article 83 GDPR. Article 39 of the law lets the Authority fine public sector bodies up to EUR 10 million. Article 38 also creates criminal offences for unlawful access to, or disclosure of, personal data, with imprisonment and fines that increase for special category data, profit motive or risks to national security.

The age of digital consent in Greece is 15. Under Article 21 of Law 4624/2019, a minor aged 15 or over can consent to the processing of their personal data for information society services offered directly to them. Below 15, processing based on consent is lawful only if the minor's legal representative gives consent.

Article 27 allows employers to process employee data where strictly necessary to decide on or perform an employment contract. Employee consent is treated as an exception, must be separate from the contract and must be explained in writing or electronically. Article 27(7) permits CCTV in the workplace only where necessary to protect people and property, and footage cannot be used to evaluate employee performance.

ISO 27001 is a voluntary information security standard, while Law 4624/2019 is a legal requirement. They overlap where the law and the GDPR require appropriate technical and organisational security measures. An ISO 27001 information security management system gives good evidence of security controls, but it does not cover Greek specific rules on consent, employee data, data subject rights or the Hellenic DPA's procedures.

Yes, on request. Law 4624/2019 is mapped in OneClickComply's control library and available on request rather than live by default. Organisations can reuse their GDPR and ISO 27001 controls, collect evidence automatically from connected tools, generate privacy policies and track risks and vendors in one place. OneClickComply does not certify compliance, but our in-house auditors can advise on Greek specific gaps.