HDPA (Greece) - 10/2026
Greece's HDPA fines two companies €160,000 for GDPR violations related to CCTV footage.
The Hellenic Data Protection Authority (HDPA) has fined two companies, MEDE S.A. and MARKET IN S.A., a total of €160,000 for multiple GDPR violations. The violations stemmed from inadequate responses to data subject access requests concerning CCTV footage, unlawful processing, and unauthorized disclosure of personal data. Both companies were found to have delayed cooperation with the DPA during the investigation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMEDE S.A. and MARKET IN S.A. failed to adequately respond to data subject access requests related to CCTV footage, unlawfully processed personal data, and disclosed it without authorization — all core GDPR obligations. Delayed cooperation with the Hellenic Data Protection Authority during the investigation compounded the violations and likely contributed to the severity of the fines. These failures highlight that GDPR compliance is not only about technical safeguards but also about having clear, documented processes for handling data subject rights and regulatory inquiries. Organizations operating CCTV systems must treat video footage as personal data subject to the full scope of GDPR protections. Failure to respond promptly to both data subjects and supervisory authorities signals a systemic lack of data governance maturity.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.