What Is Law 4624/2019?
Greece is an EU member state where the GDPR applies directly alongside Law 4624/2019, which implements the GDPR and transposes the Law Enforcement Directive. The law was published in Gazette A’ 137 on 29 August 2019. HDPA identifies its legislation page as consolidated with all amendments. The confirmed amendment history includes Laws 4829/2021, 5002/2022, 5043/2023, and Law 5221/2025, published in Gazette A’ 133 on 28 July 2025. No later instrument changing the substantive Chapter III rights or derogations discussed in the report was located. Greece has a distinctive expression-related exception: Article 28(2) disapplies GDPR Chapter III entirely where necessary for specified journalism, academic, artistic, or literary purposes. A three-month progress or outcome notification duty exists for complaints, but no fixed final-resolution deadline was located.
At a glance
- Full name
- Law 4624/2019
- Short code
- Law 4624/2019
- Jurisdiction
- Greece
- Enacted
- 2019
- Last major update
- HDPA’s current legal-framework page identifies Law 4624/2019 as without amendments for the privacy provisions discussed here; Law 5321/2026 adds the Authority’s AI-regulation implementation role without replacing the GDPR implementing framework
- Regulator
- Hellenic Data Protection Authority (HDPA)
- Private right of action
- Limited
- Statutory citation
- Law 4624/2019
Scope, who Law 4624/2019 covers
Protected data
Data subject rights
Right to information and access under GDPR Chapter III
Right to rectification
Right to erasure, subject to Greek statutory restrictions and possible substitution of restriction
Right to restriction of processing
Right to data portability
Right to object, subject to public-interest and statutory limits
Rights concerning automated decision-making and profiling
Right to complain to HDPA
Right to use the specific HDPA search-engine delisting procedure
Notable features
Article 28(2) contains a rare full disapplication of GDPR Chapter III where necessary for specified journalism, academic, artistic, or literary purposes, broader than the partial derogations identified in most other reviewed EU jurisdictions. Other distinctive points are the prohibition on genetic-data processing for health or life insurance and the narrow public-sector-only Article 39 fine.
Enforcement & penalties
Regulator: Hellenic Data Protection Authority (HDPA)
Penalties: GDPR Article 83 applies, with fines of up to €10 million or 2% of annual worldwide turnover for the lower tier and up to €20 million or 4% of annual worldwide turnover for the upper tier. Law 4624/2019 Article 39 provides a separate €10 million fine for a defined subset of public-sector bodies or controllers, subject to statutory exclusions and listed infringements. This Article 39 figure is not a universal Greek fine schedule, and no Greece-wide private-controller fine schedule was located.
Private right of action: HDPA complaint routes and the GDPR Article 77(2) three-month progress or outcome notification rule are the identified mechanisms. HDPA may exercise corrective powers but does not adjudicate compensation; compensation claims must be brought before the competent courts. A general private damages route was not otherwise identified in the reviewed Greek materials.
Relevance to data brokers
No Greece-specific data-broker complaint, registry, deletion channel, or public-record-specific deletion route was located. The identified adjacent mechanisms are the general GDPR erasure route, a specific HDPA search-engine delisting procedure, general and rights-violation HDPA complaints, and a Diavgeia enforcement precedent concerning personal data published through a government-transparency system. For ordinary GDPR-rights complaints, HDPA currently expects the person to have first exercised the right with the controller; complaints are filed through its portal, or by English email where the person cannot use the Greek Taxisnet login and Greece is the place of infringement.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What is distinctive about Greece’s journalism exception?+
Article 28(2) disapplies GDPR Chapter III entirely where necessary to reconcile data protection with specified expression and information purposes, including journalism, academic, artistic, or literary processing.
Does HDPA have a fixed deadline to finish a complaint?+
No fixed statutory final-resolution deadline was located. GDPR Article 77(2) provides a three-month progress or outcome notification rule, and HDPA expressly distinguishes that rule from final resolution, which may take considerably longer.
Does Greece have a dedicated data-broker deletion route?+
No Greece-specific data-broker complaint, registry, deletion channel, or public-record-specific deletion route was located. The reviewed materials identify general GDPR erasure, HDPA complaints, search-engine delisting, and the Diavgeia-related enforcement precedent. For an ordinary rights complaint, HDPA currently expects a prior request to the controller; it provides an online portal and an English email route in the stated cross-border circumstance.
Official sources & citations
Other international privacy regimes
Law 4624/2019 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: