HDPA (Greece) - 15/2026
Greece's HDPA fines controller €200K and processor €150K for GDPR violations.
Run HDPA?
Get an email when a reviewed story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Greece's Hellenic Data Protection Authority (HDPA) has fined a data controller €200,000 and a data processor €150,000 for violating GDPR. The violations stemmed from a known, exploitable technical vulnerability that led to an incident. The processor cited a lack of state funding for system modernization, but the HDPA ruled that public interest and resource limitations do not exempt entities from security obligations.
The lesson from this incident
Full lessonA Greek data controller and processor were fined a combined €350,000 after a known, exploitable technical vulnerability was left unremediated, leading to a data breach. The processor attempted to justify inaction by citing insufficient state funding, but the HDPA firmly rejected this argument, affirming that resource constraints do not waive GDPR security obligations under Article 32. This case underscores that 'known vulnerability' is among the most legally indefensible root causes of a breach — regulators expect timely remediation regardless of organisational size or funding model. Both controllers and processors share accountability for technical security measures, and contractual or financial limitations between parties will not shield either from regulatory consequences.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.