Our Data Privacy, Cybersecurity and Technology Briefing aims to update businesses of this recent development in the field of cybersecurity in Greece and provide key takeaways that you need to know, including:
A. Introduction
B. Who is Affected?
C. Key Obligations for Impacted Organisations
D. The Role of the National Cybersecurity Authority
E. Compliance Matters: A New Set of Harsh Fines
F. Next Steps
A. Introduction
1. On 26 November 2024, Greece successfullynavigated the NIS21 transposition path adopting measures to ensure a high common level of cybersecurity across the European Union (EU). The Hellenic Parliament formally adopted Law 5160/2024 transposing NIS2 into national law (the Greek Cybersecurity Law)2 and fulfilled its obligation under NIS23.
2. NIS2 aims to strengthen cybersecurity across the EU. Compared to its predecessor, NIS1, it covers a broader scope of entities and sectors and requires enhanced risk management and incident reporting. It has arguably introduced stricter penalties and increased cooperation between member states to address evolving cyber threats.
3. The Greek Cybersecurity Law essentially mirrors the provisions of NIS2. As of its publication in the Official Government Gazette on 27 November 2024 it has come into effect in its final form4.
B. Who is Affected?
1. Application thresholds based on business size or sector importance. The Greek Cybersecurity Law captures a broad range of entities that must adhere to compliance. It applies to public and private entities that meet specific size-related thresholds (medium sized entities and larger organisations), as well as to entities defined by their nature and services, regardless of their size.
2. Essential vs important entities classification. Entities are categorised as ‘essential’ or ‘important’ based on factors such as size, sector and criticality. Stricter or more lenient obligations apply, depending on the classification.
| TABLE 1 | |
| ESSENTIAL ENTITIES IMPORTANT ENTITIES | |
| Entities in high criticality sectors* that exceed medium size threshold | Entities in high criticality sectors* of small or medium size |
| Qualified trust service providers and top-level domain name registries, as well as domain name service (DNS) providers | Entities in other critical sectors** that exceed medium size threshold |
| Medium and large sized providers of public electronic communication networks or of publicly available communications services | Small sized providers of public electronic communication networks or of publicly available communications services |
| Public administration entity of central government | Any other entities of a type identified in the Greek Cybersecurity Law as important entities |
| Any other entities of a type identified in the Greek Cybersecurity Law as essential entities5 | |
| Entities identified as critical entities6 | |
| Operators of essential service7 | |
3. Sectors are classified as per the below (and based on such classification specific entities may fall within the categories of Table 1 above and bear certain obligations).
| TABLE 2 | |
| *High criticality sectors are: | **Other critical sectors are: |
| Energy | Postal and courier services |
| Transport | Waste management |
| Banking | Manufacture, production, and distribution of chemicals |
| Financial market infrastructures | Food production and processing |
| Health | Manufacturing |
| Drinking and waste water | Digital providers |
| Digital infrastructure (including Trust Service Providers and TLD Name Registries) | Research |
| ICT service management (B2B) | |
| Public administration | |
| Space | |
4. All entities are required to implement risk management measures and report significant cybersecurity incidents. Essential entities are subject to both ex ante and ex post supervision, while important entities are subject to ex post supervision only.
C. Key Obligations for Entities
1. Implementation of Cyber-Security Risk Management Measures (all-hazards approach). The managers of essential and important entities must approve and oversee the implementation of appropriate technical, operational, and organisational measures in order to manage risks associated with their network and information systems and to prevent or minimise the impact of incidents on service recipients within three months from Greek Cybersecurity Law’s entry into force and to oversee their implementation.
2. Cybersecurity Trainings. Members of management bodies must also undergo dedicated cybersecurity training and provide the same to their employees. The former may face personal liability for any infringements of the Greek Cybersecurity Law committed by the entity.
3. Appointment of Security of Information and Communication Systems Officer. Further to the requirements of NIS2, the Greek Cybersecurity Law mandates the appointment of an Officer responsible for the Security of Information and Communications Systems. This officer, who may not be designated under the EU General Data Protection Regulation as the Data Protection Officer (DPO) of the entity, is tasked with ensuring compliance with the requirements of the Greek Cybersecurity Law and managing communications with the National Cybersecurity Authority.
4. Incident Reporting. Entities are required to report significant incidents to the National Cybersecurity Authority (NCA) and, specifically, to its Computer Security Incident Response Team (CSIRT), without undue delay. The required reporting entails an early warning within 24 hours, an incident notification within 72 hours, an intermediate report if requested, and a final notification within one month. A cybersecurity incident is considered significant if:
a. it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;
b. it has affected or can affect other natural or legal persons by causing considerable material or non-material damage.
Additionally, entities may be required to inform the recipients of their services about such incidents.
D. The Role of the National Cybersecurity Authority (NCA)
1. The NCA is designated as the competent authority for cybersecurity and for monitoring of the implementation of the Greek Cybersecurity Law. It will act as a single point of contact to facilitate cross-border and cross-sector cooperation.
2. The NCA serves as the Cyber Crisis Management Authority and has a dedicated team (CSIRT). It is entrusted with the adoption of the National Cybersecurity Strategy, which will outline strategic objectives and priorities regarding cybersecurity and the measures needed to achieve them.
3. It shall compile a list of essential and important entities to facilitate identification of those that fall within the remit of the Greek Cybersecurity Law.
4. The NCA will establish and maintain a list of essential and important entities to accurately identify those falling within its scope. The foregoing entities will need to provide the requisite information for the creation of the list within two months from Greek Cybersecurity Law’s entry into force.
5. In addition, certain entities8 must register with the NCA’s special registry by 17 January 2025.
E. Compliance Matters: A new Set of Harsh Fines
1. The NCA has certain investigative powers, including on-site inspections, targeted security audits, security scans and requests for information, as well as regular audits vis-à-vis essential entities.
2. It may impose non-pecuniary remedies, such as warnings, recommendations, orders to comply, orders for public disclosure of infringements, and temporary suspensions of certifications or licenses, vis-à-vis essential entities, as well as administrative fines.
3. In case of failure to implement risk management measures and report significant incidents, essential entities may incur fines of up to €10m or 2% of their total worldwide annual turnover, whichever is higher, while important entities can be fined up to €7m or 1.4% of their total worldwide annual turnover, whichever is higher. Lower ceilings apply for other infringements of the Greek Cybersecurity Law, as well as for infringements by public entities.
F. Next Steps
1. The Greek Cybersecurity Law brings into reality a new set of rules to which certain organisations are required to adhere. Compared to the previous cybersecurity regime, the new rules set higher cybersecurity readiness requirements and introduce yet another layer of compliance obligations. As non-compliance can lead to substantial penalties, it is essential for legal entities in Greece to proactively prepare, by firstly identifying their obligations under the new regime and setting out a concise and comprehensive compliance plan.
* This Briefing was prepared with the assistance of Trainee Attorney Eirini Vyzirgiannaki
Download our Data Privacy, Cybersecurity and Technology Briefing.
