Hellenic DPA fines Ministry and EETAA for data breach

What happened

The Hellenic Data Protection Authority imposed administrative fines of EUR 200,000 on the Ministry of Social Cohesion and Family Affairs and EUR 150,000 on E.E.T.A.A. S.A. for a large‑scale personal data breach. The Authority also ordered the parties to conclude a data processing agreement and to fully implement security measures. The breach involved personal, financial and health data of many data subjects.

Penalty

The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A.

Why it matters for trust and compliance

• Its status is decided. The case has an outcome that others may cite.
• The decision highlights enforcement of GDPR security and processor obligations after a major data breach in a government programme.
• Takes effect July 28, 2026.
• Penalty: The Hellenic DPA imposed administrative fines of EUR 200 000 on the Ministry of Social Cohesion and Family Affairs and EUR 150 000 on E.E.T.A.A..
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Map the security requirements to existing controls and close gaps.
3. Check breach-notification procedures and timelines against the requirement.
4. Confirm handling of sensitive data categories meets the stricter rules.