INTRA/GRGreece
What the record establishes for Greece, measure by measure, and what each source requires of the measure it governs.
| Control | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|
| 16Mandatory | |||
| AW001/GRWorkforce awareness on insider riskMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, the members of the management bodies follow training and the entity gives its employees similar training at least annually, to identify risks and assess risk management practices; basic cyber hygiene and cybersecurity training are among the measures. The Υ.Π.Π.Α. designs and coordinates training on ethics and integrity and takes part in internal policies on integrity and transparency. |
| AW002/GRTransparency notice on what is observedMandatory | Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026 | That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors. | Employees are informed in writing, on paper or electronically, of the installation and operation of CCTV in the workplace; where consent is the basis, the employer informs the employee of the purpose and of the right to withdraw. |
| CP005/GRReferral to law enforcementMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | Where a significant incident is suspected to be criminal, the Εθνική Αρχή Κυβερνοασφάλειας gives the entity guidance on reporting it to the prosecuting authorities or the competent directorate of the Hellenic Police. |
| DP001/GRIdentification of critical assetsMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, a complete inventory of tangible and intangible information and communication assets is kept, ranked by criticality. |
| DP004/GRAccess control and least privilegeMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Οδηγός για τη Συμμόρφωση των Επιχειρήσεων με τον Ν. 5160/2024 και την Οδηγία NIS2ΣΕΒ (Hellenic Federation of Enterprises), with material from the Εθνική Αρχή Κυβερνοασφάλειας · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, the measures include access control policies and the use of multi-factor or continuous authentication where appropriate. Access is granted on a role with least privilege, the user reaches only the systems and data needed, and access is reviewed; the policies reach internal and external personnel over the whole access lifecycle. |
| GV001/GRProgram charter and mandateMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, the management bodies approve the cybersecurity risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches of the article. |
| GV004/GRRoles and decision rightsMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, a qualified member of staff is designated Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.), with the resources, autonomy, and access to the management bodies to coordinate compliance, incident reporting, and continuity plans; the duties are incompatible with those of the Data Protection Officer. The Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών (Υ.Π.Π.Α.) is an employee or a third party and reports directly to the top management body; other duties may not impair the independence of the role. |
| GV007/GRLawful basis registerMandatory | Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026 | That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors. | Employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance; consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically, clearly distinct from the contract, with information on the purpose and the right to withdraw; a collective agreement may provide a basis within article 88(2). |
| GV010/GRWorker representative engagementMandatory | Νόμος 1767/1988, άρθρο 13Βουλή των Ελλήνων · read 5 Oct 2026 | That the employer informs the works council, before applying the decision, of the introduction of new technology, among other matters, and provides the council with any information it asks on the matters of article 12. | The employer informs the works council, before applying the decision, of the introduction of new technology; no Greek statute located requires consultation or agreement of worker representatives before monitoring is introduced. |
| GV013/GRPeriodic program reviewMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, policies and procedures assess the effectiveness of the risk management measures, and the single cybersecurity policy of an essential entity goes to the Εθνική Αρχή Κυβερνοασφάλειας for approval of its completeness at least annually. |
| IR001/GRInsider incident playbooksMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, incident handling is among the measures, and the Υ.Α.Σ.Π.Ε. coordinates the handling of security incidents and the continuity and recovery plans. |
| IR006/GRNotification to a supervisory authorityMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, a significant incident, one causing or able to cause serious operational disruption or financial loss, or significant damage to others, is reported to the CSIRT of the Εθνική Αρχή Κυβερνοασφάλειας in an early warning within 24 hours, a notification within 72 hours, and a final report within one month; trust service providers notify within 24 hours. |
| IV001/GRInternal reporting channelMandatory | Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026 | That public bodies with 50 or more staff and private entities employing 50 or more at the same time appoint a Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών (Υ.Π.Π.Α.), that entities in financial services, transport, and the environment do so at any size, that those of 50 to 249 may share one, that the Υ.Π.Π.Α. is an employee or a third party reporting to the top management body, bound to integrity, confidentiality, and abstention on conflict, that receipt is acknowledged within seven working days and feedback given within three months, that the identity of the reporter and of any third party named is kept confidential from unauthorized persons, and that the Υ.Π.Π.Α. designs training on ethics and integrity. | A private entity employing 50 or more at the same time, and one in financial services, transport, or the environment at any size, appoints a Υ.Π.Π.Α., those of 50 to 249 may share one; the Υ.Π.Π.Α. receives reports in writing, orally, or through a platform, acknowledges receipt within seven working days, keeps the identity of the reporter and of any third party named confidential from unauthorized persons, gives feedback within three months, and informs of the routes to the external channel; failure to appoint draws a fine from the Labour Inspectorate. |
| MD014/GRVideo surveillance of the workplaceMandatory | Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026Απόφαση 23/2021Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα · read 5 Oct 2026Οδηγία 1/2011 της ΑΠΔΠΧ για τη χρήση συστημάτων βιντεοεπιτήρησης, άρθρο 7Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα · read 5 Oct 2026 | That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors. | CCTV in workplaces, publicly accessible or not, is permitted only where necessary for the protection of persons and property, and employees are informed in writing of its installation and operation. Cameras in offices, a meeting room, a secretariat, and a kitchenette, with the image transmitted in real time to the manager’s screen, breached articles 5(1)(a), 5(1)(b), and 5(2) of the Regulation; the fine was 15,000 EUR with an order to remove the cameras within one month and destroy the material. A video surveillance system is not used to monitor employees inside the workplace save in exceptional cases justified by the nature and conditions of the work and necessary for health and safety or for the protection of critical areas; in a typical office it is confined to entrances and exits, cash desks, safes, or equipment being covered with the camera on the asset, and real-time watching of operators of high-risk machinery is allowed for immediate intervention; cameras are barred from dining and recreation areas. |
| MD016/GRMeasurement of pace and performanceMandatory | Νόμος 4624/2019, άρθρο 27Βουλή των Ελλήνων · read 5 Oct 2026Οδηγία 1/2011 της ΑΠΔΠΧ για τη χρήση συστημάτων βιντεοεπιτήρησης, άρθρο 7Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα · read 5 Oct 2026 | That employees’ data are processed for the purposes of the employment contract where absolutely necessary for the decision to conclude it or for its performance, that consent is an exceptional basis judged on the employee’s dependence and the circumstances, given in writing or electronically and distinct from the contract, with information on the purpose and the right to withdraw, that collective agreements may provide a basis, that CCTV in workplaces is permitted only where necessary for the protection of persons and property, that its data are not used as a criterion for evaluating the employees’ performance, that employees are informed in writing of its installation and operation, and that employees include candidates, former employees, and contractors. | Data collected by CCTV in the workplace are not used as a criterion for evaluating the employees’ performance. Data from video surveillance are not the exclusive criterion for evaluating the employees’ behaviour and performance. |
| PS001/GRPre-employment screeningMandatory | Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026Νόμος 4990/2022, άρθρα 8, 9, and 10https://www.taxheaven.gr/law/4990/2022/arthro/9 · read 5 Oct 2026 | For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month. | For essential and important entities, the measures include human resources security, access control policies, and asset management, without the Act saying what human resources security holds. A person under prosecution or convicted for the listed offences, under disciplinary proceedings that may lead to dismissal, or suspended, may not hold the duties of Υ.Π.Π.Α. |