The Hellenic Data Protection Authority (HDPA) is an independent public authority under Article 9A of the Constitution and has its seat in Athens.
It was established by Law 2472/1997, which incorporated into the Greek legal order the European Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
By Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), which entered into force on 25/5/2018 in all EU countries, Directive 95/45/EC was repealed.
From 29/8/2019, Law 4624/2019* applies in Greece. In this law, articles 9 to 20 refer to the HDPA (supervisory authority). Law 2472/1997 has been repealed except for certain provisions expressly referred to in Article 84 of Law 4624/2019.
Law 4624/2019 also includes the transposition into the Greek legal order of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the enforcement of criminal penalties and on the free movement of such data and repealing Council Framework Decision 2008/977/JHA.
As regards the protection of personal data in the electronic communications sector, the Authority applies Law 3471/2006, which transposes Directive 2002/58/EC, as amended, into national law.
With Law 5321/2026 (‘Measures for the implementation of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Regulation on Artificial Intelligence) – Amendment of Law 4961/2022 (Government Gazette, Series I, No 146) and other provisions’, the Authority assumes a central role acting, inter alia:
-
as the competent market surveillance authority for AI systems falling under the prohibited practices of the Regulation, high-risk AI systems listed in Annex III, and AI systems subject to the transparency obligations set out in Article 50 of the Regulation;
-
as Greece's single point of contact with the European Commission and the respective national authorities;as the competent authority for receiving and handling complaints concerning infringements of the Regulation;
-
as a notified body for the conformity assessment of certain high-risk AI systems, and
-
and, together with the Hellenic Telecommunications and Post Commission (EETT), as the competent authority for the operation of the national Artificial Intelligence regulatory sandbox (AI Sandbox).
Since 26 June 2025, the duties of President of the Authority have been performed by Deputy President Georgios Batzalexis, Honorary Areopagite.
The Authority is supported by its own Secretariat, which operates at the level of a General Directorate and has its own budget.
*“Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions”.
