Security Alert
Greece ratified the Protocol amending the Council of Europe’s Convention for the Protection of Individuals regarding Automatic Processing of Personal Data, originally opened for signature in 2018. New Greek Law 5169/2025 supplements existing data protection legal framework and underscores Greece's commitment to further align with international standards regarding data protection and privacy.
What is the Amending Protocol to Convention 108
The Amending Protocol to Convention 108 is a significant update to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, aiming to modernise the Convention and to address contemporary challenges posed by advancements in technology and the globalised nature of information processing.
Key objectives
| Increased Scope | The Amending Protocol to Convention 108 extends the scope of the Convention to effectively include all types and new forms of data processing, such as those involving artificial intelligence (AI) and big data, and more categories of personal data (e.g., genetic and biometric data). |
| Improved Rights for Individuals | It introduces several new rights for individuals aligning the Convention with the GDPR and expanding individuals' rights to control their personal data. |
| Cross-border Data Flows | It aims to create a more predictable and consistent legal framework for cross-border data transfers. |
| International Cooperation | It aims to promote greater cooperation between countries in terms of data protection, making it easier for them to collaborate on enforcement and oversight. |
Supplementary application of the existing legal framework
In the event that an issue arises concerning the application of the Amending Protocol to Convention 108, the existing legal framework -including the GDPR and Law 4624/2019- will continue to apply in a complementary manner. This encompasses, for example, provisions related to appeals and remedies before the Supervisory Authority and the courts, as well as the enforcement of sanctions for any violations of the provisions set forth in the Convention.
What we can do for you
Our firm’s Data Protection & Cybersecurity team is one of the longest established and highly specialised practices in Greece, offering top quality expertise to our clients and practical solutions that make impact on their business.
Using our 40+ years’ experience in this area, we advise leading multinational companies, many of which are heavily regulated, on data protection, privacy and information security, covering all angles (legal and IT) and all lines of service (counselling & compliance, DPO as a service, data breach management, DPIAs, litigation), delivering implementable advice.
Learn more
Data Protection & Cybersecurity
AI Compliance programme