HDPA (Greece) - 7/2026
Greek DPA fines energy supplier and call centers €880,000 for GDPR violations.
The Greek DPA has fined DEI S.A. and four call-center operators a total of €880,000 for violating GDPR. The violations included inadequate technical and organizational measures, mixed-purpose calls, insufficient processor oversight, and unauthorized use of a subcontractor. Complaints arose from data subjects receiving promotional calls despite being on the national opt-out register or having previously requested not to be contacted.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DEI S.A.?
Get an email when a new story names DEI S.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDEI S.A. and its call-center operators failed to implement adequate technical and organizational measures to respect data subjects' opt-out preferences, resulting in unlawful promotional calls to individuals registered on the national do-not-call list. A key failure was the unauthorized engagement of a subcontractor without proper authorization or oversight, violating GDPR's strict processor accountability requirements under Articles 28 and 29. Mixed-purpose calls—combining service and promotional content—further obscured consent boundaries and made it impossible to honor data subjects' objections effectively. This case illustrates that GDPR liability extends across the entire processing chain: controllers cannot delegate compliance responsibility to processors without rigorous contractual and operational controls. The €880,000 fine underscores that consent and objection management failures carry significant financial and reputational consequences.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.