[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh3fAfbAFxn8vCe0Q7xMwi27p-TaqOlTbKn3TPy-m6t0":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":67},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"f4e98b3e-069f-4a5e-8f5d-4f9e1b9405a9","HDPA (Greece) - 19\u002F2026","hdpa-greece-19-2026-760dcc","Created page with \"{{DPAdecisionBOX |Jurisdiction=Greece |DPA-BG-Color= |DPAlogo=LogoGR.jpg |DPA_Abbrevation=HDPA |DPA_With_Country=HDPA (Greece) |Case_Number_Name=19\u002F2026 |ECLI= |Original_Source_Name_1=HDPA |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-11\u002F19_2026%20anonym.pdf |Original_Source_Language_1=Greek |Original_Source_Language__Code_1=EL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |T...\" Show changes","Greece's Data Protection Authority (HDPA) has fined Service 800 Teleperformance Single Member S.A. €100,000 for failing to adequately respond to a former employee's data subject access request. The company cited data deletion policies and account deactivation as reasons for not providing requested emails and other information, which the DPA found to be a systemic compliance failure.","Greece's HDPA fines a company €100,000 for failing to respond to a data subject access request.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_19\u002F2026&diff=53596&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-11-03T14:45:54+00:00","2026-11-03T15:00:36.057043+00:00",7,[17,20],{"name":18,"type":19},"Service 800 Teleperformance Single Member S.A.","vendor",{"name":21,"type":22},"GDPR","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":21,"slug":26},null,"gdpr",[28,30,35,40],{"category":29},{"id":23,"icon":25,"name":21,"slug":26},{"category":31},{"id":32,"icon":25,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":25,"name":38,"slug":39},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":66},[49],{"slug":50,"name":51,"problem":52,"products":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[54,60],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":55,"product_name":56,"url":58,"description":59},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":61,"product_name":62,"url":64,"description":65},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":68,"title":69,"body":70,"framework_refs":71,"framework_notes":79},"greek-dpa-fines-teleperformance-100k-for-failing-to-honour-data-subject-access-request","Greek DPA Fines Teleperformance €100K for Failing to Honour Data Subject Access Request","Service 800 Teleperformance failed to adequately respond to a former employee's data subject access request (DSAR), citing data deletion policies and account deactivation as justifications for withholding emails and personal information. The HDPA ruled this constituted a systemic compliance failure, not a legitimate technical limitation. Organisations must balance routine data deletion practices with the legal obligation to locate and provide personal data upon request. This case illustrates that poor DSAR workflows and inadequate data inventory management can expose organisations to significant regulatory fines even without a traditional cyberattack.",[72,73,74,75,76,77,78],"GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 32":80,"NIST SP 800-53 SI-2: Flaw Remediation":81,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":82,"CIS Control 17: Incident Response Management":83,"CIS Control 14: Security Awareness and Skills Training":84,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":85,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":86},"Article 32 requires appropriate technical and organisational measures to ensure data can be accessed and managed lawfully; the failure to retrieve personal data in response to a DSAR reflects a gap in exactly these organisational measures.","The systemic process failure in handling the DSAR is analogous to an unresolved procedural flaw; SI-2's principle of identifying and correcting flaws in organisational processes would have prompted remediation of the broken DSAR workflow.","Staff handling DSARs lacked demonstrated competence in fulfilling data subject rights obligations, and Clause 7.2 requires organisations to ensure personnel are trained and competent for roles with information security and compliance implications.","Receiving a DSAR from a former employee should trigger a defined response procedure; the absence of such a procedure mirrors the lack of an incident response plan, leading to an ad-hoc and ultimately non-compliant outcome.","Employees and managers responsible for data subject requests were evidently unaware of their legal obligations, and structured awareness training covering privacy and compliance would have prevented this gap.","While primarily about technical flaws, the underlying principle of maintaining awareness and control over information assets directly applies to knowing where personal data resides so it can be surfaced on request.","Proper identity lifecycle management—including retention of data associated with former employee accounts—would have ensured personal data remained accessible for legitimate legal requests even after account deactivation."]