HDPA (Greece) - 15/2026
Greece's HDPA fines Ministry and Company €350K for data breach and lack of contract.
Greece's Hellenic Data Protection Authority (HDPA) has fined the Ministry of Social Cohesion and Family €200,000 and the Hellenic Local Development and Local Government Company €150,000 following a data breach. The breach affected approximately 2.5 million individuals and involved databases for childcare and nanny programs. The HDPA found both parties in violation of Article 28(3) of the GDPR due to the absence of a contract between the controller and processor, despite the breach occurring on the processor's systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe breach exposed personal data of approximately 2.5 million individuals enrolled in childcare and nanny programs, yet the most critical finding was not the breach itself but the complete absence of a Data Processing Agreement (DPA) between the data controller and processor, a fundamental GDPR requirement under Article 28(3). Without a formal contract, neither party had clearly defined obligations for security measures, breach notification, or data handling responsibilities. This gap left millions of citizens' data inadequately governed, making accountability and remediation significantly harder. The case underscores that regulatory compliance is not just a documentation exercise — it is a foundational governance mechanism that directly enables security accountability across third-party relationships.