HDPA (Greece) - 15/2026
Greece's HDPA fines two entities €350K for GDPR violations following a data breach.
Greece's Hellenic Data Protection Authority (HDPA) has imposed fines totaling €350,000 on two entities for GDPR violations related to a data breach. The breach, which affected approximately 2.5 million individuals, involved the encryption and potential exfiltration of sensitive data. The controller blamed the processor, citing system vulnerabilities and lack of funding for necessary upgrades, while the processor highlighted public interest and reliance on state funding for modernization.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe HDPA imposed significant fines on both a data controller and processor following a breach that encrypted and potentially exfiltrated sensitive data belonging to approximately 2.5 million individuals. The root failure lies in unpatched system vulnerabilities left unaddressed due to budget constraints and inadequate modernization — excuses that carry no legal weight under GDPR. Critically, the controller-processor relationship lacked proper accountability structures, with each party deflecting responsibility rather than maintaining joint due diligence. This case reinforces that GDPR obligations cannot be waived on grounds of funding shortfalls, and both controllers and processors share enforceable responsibility for technical safeguards. The scale of the breach and the regulatory response highlight that neglecting vulnerability management in public-sector or state-funded environments poses enormous legal and reputational risk.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.