Our Data Privacy, Cybersecurity and Technology Briefing analyses some important recent developments in relation to cybersecurity law and the new rules for entity registration and appointment and role of the Information and Communication Systems Security Officer (ICSSO), including:
A. Registration and Data Submission to the NCSA (JMD 1990/2025)
B. Appointment and Role of the ICSSO (JMD 1899/2025)
C. Practical Next Steps for Businesses
Greece recently adopted a new set of secondary rules complementing the provisions of the Greek Cybersecurity Law (Law 5160/2024)1 and specifying certain obligations for the affected legal entities.
Notably, Joint Ministerial Decisions 1899/2025 and 1990/20252 introduce significant updates regarding registration and data submission to the National Cybersecurity Authority (NCSA)3, as well as the appointment of an Information and Communication Systems Security Officer (ICSSO).
The legislative cybersecurity framework was also enhanced earlier this year by the issuance of JMD 1689/2025 which established the National Cybersecurity Requirements Framework4, setting out technical, organisational, and operational risk-management measures, as well as JMD 1381/2025 which governs the NCSA registration process5.
The purpose of this Briefing is to keep affected legal entities up to date by providing a high-level description of the recent regulatory updates.
Extended Deadline. The deadline for registration (and the submission of complementary data) has now been extended to 30 September 20256.
Updated Templates. The information to be submitted has been expanded. Entities must now provide additional information7 (particularly SME status and ICSSO details).
Registration Process. All entities within the scope of the Greek Cybersecurity Law must register via the dedicated NCSA digital platform by the extended deadline8. Exceptionally, email submissions are permitted if technical or other reasons prevent use of the platform9.
Entities Previously Registered via Email. Entities that have already registered by email are considered compliant but must re-register on the digital platform, citing the protocol number of their initial registration and providing any additional information now required (in particular, SME status and ICSSO details)10.
Senior Scope. JMD 1899/2025 applies to all entities classified as 'essential' or 'important' and sets out the qualifications, duties, incompatibility and obligations of the ICSSOs.
Entry into force. JMD 1899/2025 will enter into force on 1 November 2025.
Qualifications. The ICSSO must be familiar with the entity’s business operations and meet specific formal qualifications11.
Integrity requirements. Individuals with irrevocable convictions for specific criminal offences are ineligible. Entities must obtain a criminal record extract for each candidate, and the NCSA may request this at any time12.
Affiliation. The ICSSO must be a staff member of the obliged entity. Exceptionally, an ICSSO may be appointed from another undertaking within the same group13.
Conflicts of interest. The ICSSO may not simultaneously serve as the Data Protection Officer (DPO) or be responsible for IT/ICT management or e-governance within the same entity, to avoid conflicts of interest14.
Background checks. Entities are required to conduct background checks on ICSSO candidates prior to appointment, tailored to the sensitivity of the role and the level of access to critical systems and information. The checks must consider professional experience, ethics, and integrity, and be conducted in compliance with all applicable data protection laws, observing the principles of proportionality, confidentiality, and good faith15.
Responsibilities16. The key responsibilities of the ICSSO include but are not limited to:
a. overseeing the security of all network and information systems;
b. supervising the implementation of cybersecurity measures and policies;
c. acting as the main point of contact with the NCSA;
d. ensuring compliance with all legal and regulatory cybersecurity requirements;
e. coordinating cybersecurity training and awareness;
f. overseeing supply chain security in procurement and contract management;
g. maintaining up-to-date records of IT and communication assets;
h. participating in audits and inspections; and
i. monitoring new technologies to improve cybersecurity.
Confidentiality and data protection. The ICSSO is bound by confidentiality obligations and must consult the DPO on matters related to the protection of personal data17.
Autonomy and resources. The ICSSO must have sufficient autonomy, direct reporting lines to top-level management, and authority to coordinate incident management and business continuity plans18.
Additional rules for public bodies. Specific supplementary provisions apply to central government bodies, and the ICSSO role is incompatible with that of the Data Usage Officer19.
Determine applicability. Assess whether your organisation is classified as an 'essential' or 'important' entity under the Greek Cybersecurity Law.
Register by 30 September 2025. If not yet registered, complete the process through the NCSA digital platform before the deadline.
Update existing registration. Entities already registered (e.g., by e-mail) must re-submit their details on the platform, including ICSSO details and SME status.
Streamline cybersecurity compliance. Develop and execute a roadmap to achieve and maintain compliance with all cybersecurity obligations under the Greek Cybersecurity Law and its implementing regulations.
This Briefing aims to provide you with high level information and alert you to the newly adopted requirements. It is not meant to be an exhaustive analysis of the legal provisions and their applicability to businesses. Please do not hesitate to reach out for more information.
* This Briefing was prepared with the assistance of Trainee Attorney Eirini Vyzirgiannaki
1 See our Briefing on the enactment of the Greek Cybersecurity Law, its scope of application, and key compliance obligations here.
2 Joint Ministerial Decision 1899/27.07.2025 (Government Gazette B’ 4250/05.08.2025) (JMD 1899/2025) and Joint Ministerial Decision 1990/28.07.2025 (Government Gazette B’ 4241/04.08.2025) (JMD 1990/2025).
3 The NCSA is tasked with overseeing compliance.
4 Joint Ministerial Decision 1689/30.04.2025 (Government Gazette B’ 2186/06.05.2025) (JMD 1689/2025). See our Briefing on the National Cybersecurity Requirements Framework here.
5 Joint Ministerial Decision 1381/10.02.2025 (Government Gazette B’ 463/10.02.2025) (JMD 1381/2025). See our Briefings on the NCSA registration process and related cybersecurity rules here and here.
6 The extended deadline applies for the registration obligations under Article 4(3) and 19(1) of the Greek Cybersecurity Law. Article 9 of JMD 1381/2025 as amended by Article 1(1) of JMD 1990/2025.
7 This includes the information required from all essential and important entities obligated to register under Article 4(3) of the Greek Cybersecurity Law and Template I of JMD 1381/2025 as amended by Article 1(2) of JMD 1990/2025. Template II of JMD 1381/2025, applicable to entities with additional registration obligations under Article 19(1) of the Greek Cybersecurity Law, has also been expanded by means of Article 1(3) of JMD 1990/2025.
8 The digital platform can be accessed at nis2register.cyber.gov.gr using TaxisNet credentials of the obliged entity.
9 Article 8(3) of JMD 1381/2025.
10 Relevant obligation was clarified by means of NCSA’s press release of 6 August 2025.
11 Specifically, these may be satisfied in one of three ways: by holding a relevant undergraduate or postgraduate degree (with a duration of at least one year) in information or network security or cybersecurity; by having at least five years of professional experience in these areas; or by possessing certified knowledge of relevant security methodologies, tools, and standards, along with a minimum of two years of practical experience in the field. Article 4(1) of JMD 1899/2025.
12 Article 4(2) of JMD 1899/2025.
13 Article 3(1) of JMD 1899/2025.
14 Article 4(3) and (4) of JMD 1899/2025.
15 Article 5 of JMD 1899/2025.
16 Article 6(1) of JMD 1899/2025.
17 Article 6(2) and (3) of JMD 1899/2025.
18 Article 6(4) of JMD 1899/2025.
19 Article 7 of JMD 1899/2025.
