EU regulation

The GDPR contains a general requirement for a personal data breach to be notified by the controller to its supervisory authority, and for more serious breaches to also be notified to affected data subjects. A "personal data breach" is a wide concept, defined as any "breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed" (Article 4).

The controller must notify a breach to the supervisory authority without undue delay, and where feasible, not later than 72 hours after having become aware of it, unless the controller determines that the breach is unlikely to result in a risk to the rights and freedoms of natural persons. When the personal data breach is likely to result in a high risk to natural persons, the controller is also required to notify the affected data subjects without undue delay (Article 34).

Where the breach occurs at the level of the processor, it is required to notify the controller without undue delay upon becoming aware of the breach (Article 33(2)).

The notification to the supervisory authority must include where possible the categories and approximate numbers of individuals and records concerned, the name of the organization’s data protection officer or other contact, the likely consequences of the breach and the measures taken to mitigate harm (Article 33(3)).

Controllers are also required to keep a record of all data breaches (Article 33(5)) (whether or not notified to the supervisory authority) and permit audits of the record by the supervisory authority.

Greece regulation

The Greek Data Protection Law does not derogate from the provisions of the GDPR.

It is worth noting, however, that it provides for an additional exception from the obligation to communicate data breaches to the data subject under Article 34 GDPR. Article 33 (5) of the Greek Data Protection Law provides that in addition to the exception established in Article 34 (3) GDPR, the obligation to communicate a personal data breach to the data subject does not apply when such notification would lead to disclosure of information which must be kept confidential by operation of law or due to their nature, unless the data subject’s interests take precedence.

Further, according to the Hellenic Data Protection Authority (“HDPA”), the procedure to be followed for a Data Breach Notification is the following:

• The Controller may complete the relevant form and submit it to the HDPA electronically via its web portal;
• By way of exception, as regards entities that are not established in Greece, the notification of the data breach procedure may be made via email.

Parallel application of data protection and cybersecurity law

According to Article 27 (1) of the Greek Cybersecurity Law, where the National Cybersecurity Authority, acting in the context of its supervisory and enforcement powers, finds that a breach of the minimum cybersecurity requirements of Articles 15 and 16 of the Greek Cybersecurity Law  (cybersecurity management measures or incident reporting requirements) involves a personal data breach as defined in Article 4(12) of GDPR, which must be notified in accordance with Article 33 of that Regulation to the Hellenic Data Protection Authority (‘HDPA’), the National Cybersecurity Authority shall inform the HDPA without undue delay.