'the team is intelligent, professional and cooperative, and they always act with diligence and professionalism'
The Legal 500 EMEA 2026
'great team with excellent technical skills and attention for details'
The Legal 500 EMEA 2024
'highly specialised … dedicated partners ... excellent technical knowledge and attention to detail'
The Legal 500 EMEA 2023
Our practice advises all market participants on the increasingly complex legislation governing data privacy, security and digital risk. We have extensive expertise in advising clients operating across a variety of industry sectors on emerging and existing data privacy requirements.
We act on cyber incidents often with cross border elements aligning data breach obligations with NIS2 reporting requirements to deliver defensible, regulator-ready outcomes. Our specialized privacy team is committed to offering practical, business-oriented advice and to helping clients ensure compliance and manage risk. We help companies to develop tailored compliance programs and policies, provide on-site and online employee training, including mock exercises, and work closely with clients to proactively mitigate data privacy and security risks. Our aim to assist our clients achieve their commercial and transactional goals within a complex legislative framework.
Privacy Compliance & Risk Management
We advise on all aspects of privacy and data protection matters, including GDPR compliance, employees' data processing, compliance with EU and local privacy laws, risk management and the development of new digital business models and products (privacy by design). Clients rely on us for support on compliance with the legislation and regulations in place governing the administration of customer, client and employee information and management of the associated reputational and financial risks. We have extensive experience in drafting and negotiating complex privacy agreements, including privacy policies and procedures, and advising on website issues, cybersecurity and data breaches, data exports, as well as the handling of data subjects' requests. Our team has vast experience in providing sector specific services for areas of processing such as human resources, biometric data, whistleblowing, public relations, e-Privacy, marketing and the use of cookies, closed circuit television (CCTV), call recording, banking and health. We regularly assist clients in adapting to and implementing global compliance programs and policies in conformity with regulatory developments, including assisting them to set up internal whistleblowing channels for the report of EU law breaches according to the requirements of the EU Whistleblowing Directive and relevant national rules.
Regulatory Proceedings & Disputes
Our team regularly assists companies in responding to regulatory inquiries from the national regulatory authority (HDPA). Where potential infringements do occur, we represent clients at every stage of an investigation as well as with administrative or legal proceedings. We have particular expertise in representing companies facing HDPA investigations into employees' data processing, data transfers and data security issues. We work closely with our litigation attorneys to successfully represent our clients in privacy disputes before the Courts.
Transactional Matters
We regularly assist our clients with data privacy and cybersecurity matters that arise in connection with transactional projects, often advising on privacy and data security related risks from the processing of consumer, customer and employee data. We work closely with our M&A team in the context of due diligence projects and transactional documents.
Cybersecurity & Data Breach
We have broad experience in handling complex cybersecurity and data breach incidents, including assisting clients in containing the incident and implementing risk mitigation measures to protect services and data without disrupting internal operations. We advise multiple corporates across various industry sectors under the newly enacted Greek Cybersecurity Law, providing scoping, initial assessment, and legal assistance with registration and compliance. We have experience in liaising with the National Cybersecurity Authority on behalf of our client on niche cyber security compliance issued. We advise on network and information security requirements arising from network security rules and work closely with companies in identifying security compliance gaps. We also assist clients to assess potential data security breaches and develop incident response plans and policies.
Recent Experience
Ransomware Incident Response
We successfully supported a leading software company in navigating a ransomware attack. In addition, we advised in relation to incident response protocols and NIS2 obligations for managed service providers under the Greek Cybersecurity Law.
Cross Border Data Breach Incident
We advised a technology company on Greek aspects of a significant cross border data breach, guiding HDPA notifications, refining breach narratives for cross jurisdictional consistency and local defensibility, and addressing procedural and substantive compliance requirements.
Compliance on Collection of Biometric Data
We advised on compliance for collecting and transferring employee biometric data from Greece to a third jurisdiction, for regulatory checks.
NIS2 Compliance Program
We advised multiple clients across various industry sectors on the Greek Cybersecurity Law implementing NIS2, including scoping, initial assessments, registration and compliance requirements, and incident reporting before the National Cybersecurity Authority
Hellenic Data Protection Authority Investigation and Overall GDPR Compliance
We are advising a company in the context of an investigation by the Hellenic Data Protection Authority (HDPA) relating to data access rights, assisting with regulator questionnaires and coordinating with the European Data Protection Board, while guiding ongoing GDPR compliance and data transfer mechanisms.
Whistleblowing Compliance in Dual Listing
In the context of the dual listing of Metlen Energy & Metals SA, one of Greece's largest listed companies, we provided extensive legal support on the whistleblowing scheme of the Greek entity, assisting the company in achieving full compliance with applicable whistleblowing rules.
Advice on Whistleblowing and Reporting of Breaches
We advise an international technology solutions and software provider in relation to employment matters and compliance of its global policies with local law requirements, including data privacy and whistleblowing requirements following the enactment of legislation incorporating in Greece the EU Whistleblowing Directive for the reporting of EU law breaches.
Biometric Identity Verification
We advised a company on its envisaged biometric identity verification solution in Greece
Migration of Corporate Datasets
We advised a company active in financial services on the cross-border migration of diverse data sets to US-based cloud storage.
Clinical Trial Data Protection Compliance
We advised Hikma Pharmaceuticals on GDPR compliance for clinical trials in Greece, covering patient consent processes, cross border data transfers and contractual structuring with sponsors, CROs and sites to ensure robust regulatory adherence.
Data Protection Impact Assessment on DEI Initiatives
We advised a private equity firm on data protection and supported them through the conduct of a Data Protection Impact Assessment for its diversity, equity and inclusion initiatives.
DPO Support for a Greek Banking Institution
We are providing DPO related support services to a banking institution assisting with the entire spectrum of GDPR matters and major compliance projects.
GDPR in Secondary Sale of NPL Portfolio
We advised AP Hermes Securitisation on the acquisition of a circa €700m NPL portfolio, structuring borrower notifications under sector specific privacy rules, drafting GDPR compliant documentation and frameworks for licensed servicers, and addressing complex warranties and undertakings in a secondary securitisation sale.
GDPR Implementation in Healthcare Acquisition
We advised a healthcare company on the acquisition of a fertility clinic, covering corporate, commercial and regulatory aspects of medically assisted reproduction, and post closing GDPR compliance, including cookie use assessment, risk quantification and full alignment with data protection rules.
Advice in E-commerce Sector
We advised an international e-commerce company specialized in online travel in connection with the ex officio investigation of the Hellenic Data Protection Authority in the online and e-commerce sectors, including providing advice on e-privacy related matters, such as marketing communication and cookies.
