[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcxKFV-wuPmeoYW3VNLPf5XnS_tzxlZTj05fXGzRF5qE":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7efdd992-c730-4041-b718-aab248475b05","HDPA (Greece) - 15\u002F2026","hdpa-greece-15-2026-0c2156","← Older revision Revision as of 11:42, 8 September 2026 Line 103: Line 103: The Ministry of Social Cohesion and Family (the controller), and the Hellenic Local Development and Local Government Company (the processor) notified the DPA that information systems operated by the processor were subject to a data breach. The Ministry of Social Cohesion and Family (the controller), and the Hellenic Local Development and Local Government Company (the processor) notified the DPA that information systems operated by the processor were subject to a data breach. The data breach concerned databases used for the implementation of '''XXX'''. These databases included data relating to staff, legal representatives of the organisation, the applicants, and the beneficiaries of '''XXX''' (which included children) affecting a total of approximately 2,500,700 data subjects. The processor also suffered disruption of the systems. The data breach concerned databases used for the implementation of two initiatives, the Daycare Centers Program and the Neighborhood Nannies Program. These databases included data relating to staff, legal representatives of the organisation, the applicants, and the beneficiaries of the initiatives (which included children) affecting a total of approximately 2,500,700 data subjects. The processor also suffered disruption of the systems. The controller blamed the incident on the processor and claimed that upon noticing the breach they immediately acted in compliance with the GDPR, notifying both the DPA and the processor, and took all necessary measures to restore the availability of the systems, and minimise the impact on data subjects. The controller blamed the incident on the processor and claimed that upon noticing the breach they immediately acted in compliance with the GDPR, notifying both the DPA and the processor, and took all necessary measures to restore the availability of the systems, and minimise the impact on data subjects. Line 124: Line 124: Absence of contract Absence of contract Furthermore, in its investigation the DPA found that there was no active contract between the processor and the controller, covering the implementation of the initiatives and the associated processing operations, the DPA found both the controller and processor in violation of [[Article 28 GDPR|Article 28(3) GDPR]]. Furthermore, in its investigation the DPA found that there was no active contract between the processor and the controller, covering the implementation of one of the initiatives and the associated processing operations, the DPA found both the controller and processor in violation of [[Article 28 GDPR|Article 28(3) GDPR]]. As a result of the findings, the DPA imposed a fine of €200,000 on the data controller and 150,000 on the data processor, and ordered them to, effective immediately, enter into the contract required by [[Article 28 GDPR|Article 28(3) GDPR]]. As a result of the findings, the DPA imposed a fine of €200,000 on the data controller and 150,000 on the data processor, and ordered them to, effective immediately, enter into the contract required by [[Article 28 GDPR|Article 28(3) GDPR]].","Greece's Hellenic Data Protection Authority (HDPA) has fined the Ministry of Social Cohesion and Family €200,000 and the Hellenic Local Development and Local Government Company €150,000 following a data breach. The breach affected approximately 2.5 million individuals and involved databases for childcare and nanny programs. The HDPA found both parties in violation of Article 28(3) of the GDPR due to the absence of a contract between the controller and processor, despite the breach occurring on the processor's systems.","Greece's HDPA fines Ministry and Company €350K for data breach and lack of contract.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_15\u002F2026&diff=52949&oldid=52947","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-09-08T11:42:31+00:00","2026-09-08T12:00:19.335591+00:00",7,[17,20],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,38,43],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":21,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":39},{"id":40,"icon":25,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":63},"greece-fines-ministries-350k-for-missing-gdpr-processor-contract-after-25m-record-breach","Greece Fines Ministries €350K for Missing GDPR Processor Contract After 2.5M-Record Breach","The breach exposed personal data of approximately 2.5 million individuals enrolled in childcare and nanny programs, yet the most critical finding was not the breach itself but the complete absence of a Data Processing Agreement (DPA) between the data controller and processor, a fundamental GDPR requirement under Article 28(3). Without a formal contract, neither party had clearly defined obligations for security measures, breach notification, or data handling responsibilities. This gap left millions of citizens' data inadequately governed, making accountability and remediation significantly harder. The case underscores that regulatory compliance is not just a documentation exercise — it is a foundational governance mechanism that directly enables security accountability across third-party relationships.",[55,56,57,58,59,60,61,62],"GDPR Article 28(3) — Controller-Processor Contracts","GDPR Article 33 — Breach Notification to Supervisory Authority","GDPR Article 24 — Responsibility of the Controller","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 CA-3 (System Interconnections)","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27001 Annex A.15 — Supplier Relationships","ITIL — Supplier Management Practice",{}]