Complaint to the Hellenic DPA

The DPA is competent to handle complaints and investigate, if deemed necessary in cooperation with supervisory authorities of other EU member states, cases of alleged violations of data protection law.

Who can submit a complaint?

The following persons have the right to submit a complaint to the Hellenic DPA:

  • Data subjects, especially if Greece is their usual country of residence or work or location of the alleged violation. Data subjects have the right to assign non-profit bodies or organizations or unions or associations that legally operate, have statutory goals of general interest and operate in the field of protection of rights and freedoms of data subjects with regard to data protection, to submit a complaint, to the Hellenic DPA, on their behalf.

  • Subscribers or users of e-communication services (regardless if they are natural persons), exclusively for issues concerning violation of the specialized legislation for the processing of personal data in electronic communications (e-Privacy), which fall within the competence of the Hellenic DPA.

What kind of complaints does the Hellenic DPA examine?

The DPA examines the following complaints that fall within its competence:

  1. Violation of data subjects’ rights provided in articles 15 to 22 of GDPR under the condition that the data subject has already exercised her/his rights to the controller, where applicable, and either s/he hasn’t received a reply within the time frame provided for in the article 12 par. 4 of GDPR (one month, with a conditional two month extension) or the reply s/he received by the controller is not satisfactory.

  2. Unlawful processing of their personal data, which is violating the provisions for the protection of personal data (GDPR, law 3471/2006 for the protection of personal data in e-communications) and provided that they have appealed to the controller and their issue hasn’t been resolved.

  3. Also, the subscriber or user affected, regardless if he she is a natural person, has the right to submit a complaint in these cases:

  4. Violation of provisions for conducting phone calls for the promotion of goods or services (art. 11 par. 1 and 2 of law. 3471/2006), and

  5. Violations of provisions for sending unsolicited promotional e-mails (art. 11 law 3471/2006), as e-mail and sms.

When can I submit a complaint to the DPA?

Before you submit a complaint, you must appeal to the controller, e.g. exercising the rights that are provided for by 15 to 22 of GDPR, where applicable. In case the controller has appointed a Data Protection Officer (DPO), you can contact her/him for every issue about the processing of your data and also asking guidance for the exercise of your rights. The DPO information is published usually on the website of the controller.

If the issue is not resolved you may submit a complaint to the DPA.

In case the aforementioned procedure is not followed, the DPA might not examine your complaint.

Does the Hellenic DPA examine every complaint?

Complaints that are vague, unsubstantiated, are submitted abusively, especially due to a repetitive pattern, are filed anonymously or do not include the required information may be deemed inadmissible (archived) by the Hellenic DPA. Before you submit a complaint, please make sure that you have at least filled in the required fields.

To what extent does the DPA examine the complaints?

According to article 57 par. 1f of GDPR, the DPA investigates, to the extent appropriate, the subject matter of every complaint. Consequently, the extent in which every complaint is examined depends on the DPA’s judgement.

Can I ask the DPA to adjudicate compensation in case of a violation?

No. The Hellenic DPA is competent to exercise corrective powers (including fines) to controllers or processors but not to adjudicate compensation to the aggrieved data subjects. In case you seek compensation, you should exercise your rights before a court.

More particularly, according to provisions of articles 79 to 82 of GDPR, you have the right to a) judicial recourse, if you think that your rights have been violated as a result of personal data processing and b) compensation before the competent courts for the damage you have undergone by the controller or the processor, as a result of GDPR violation.

How is a complaint submitted?

The complainants submit their complaints by filling in a different form for each case. In every form there are mandatory fields depending on the case. If these are not filled, the DPA has the right not to examine the case regardless of the way a form is used and the required information is not provided for.

Complaints that are vague, unsubstantiated, are submitted abusively, especially due to a repetitive pattern, are filed anonymously or do not include the required information may be deemed inadmissible (archived) by the Hellenic DPA.

Complaint form


docx / pdf

Violation of right (art. 15 - 22 GDPR)

docx / pdf

Unlawful phone calls for the promotion of goods and services

docx / pdf

Unsolicited promotional e-mails (email/sms) - SPAM

docx / pdf

Unlawful processing (used for every violation that doesn’t fall into any of the three categories above)

You may submit the complaint form in the following ways:

  • By email to:

  • By post to the Authority:

    • Hellenic Data Protection Authority, Kifisias Avenue 1-3, 115 23 - Αthens

  • By submitting it in person at the Authority (1st floor)

    • o Opening hours of the Protocol’s office: 9:00 – 13:00

  • Fax to +30 210 6475628