Hellenic DPA fines ministry €200,000 and E.E.T.A.A. €150,000 over security failures

What happened

• The Hellenic Data Protection Authority investigated a large-scale breach at E.E.T.A.A. S.A., which processes data for the Ministry of Social Cohesion and Family Affairs.
• The breach exposed personal, financial and health data of many citizens.
• The Authority found the Ministry had met breach‑notification duties, but both parties failed to secure the systems and to have a proper Article 28 processing agreement.
• It imposed administrative fines of €200,000 on the Ministry and €150,000 on E.E.T.A.A. and ordered a compliant data‑processing contract and security upgrades.

Why it matters

Greek public bodies must ensure up‑to‑date security controls and formalised Article 28 processor agreements, or risk similar fines.

Business impact

Failure to modernise legacy IT and formalise contracts can lead to significant financial penalties and mandatory remediation projects.

What to check

1. 1

   Review processor contractsHigh priority

   Ensure all data‑processing agreements meet GDPR Article 28 requirements.

2. 2

   Upgrade security measuresHigh priority

   Replace outdated information systems and implement robust technical safeguards.