HDPA (Greece) - 19/2026
Greece's HDPA fines a company €100,000 for failing to respond to a data subject access request.
Greece's Data Protection Authority (HDPA) has fined Service 800 Teleperformance Single Member S.A. €100,000 for failing to adequately respond to a former employee's data subject access request. The company cited data deletion policies and account deactivation as reasons for not providing requested emails and other information, which the DPA found to be a systemic compliance failure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Service 800 Teleperformance Single Member S.A.?
Get an email when a new story names Service 800 Teleperformance Single Member S.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonService 800 Teleperformance failed to adequately respond to a former employee's data subject access request (DSAR), citing data deletion policies and account deactivation as justifications for withholding emails and personal information. The HDPA ruled this constituted a systemic compliance failure, not a legitimate technical limitation. Organisations must balance routine data deletion practices with the legal obligation to locate and provide personal data upon request. This case illustrates that poor DSAR workflows and inadequate data inventory management can expose organisations to significant regulatory fines even without a traditional cyberattack.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.