Complaint to the Hellenic DPA

The Hellenic DPA is competent to handle complaints and investigate, if deemed necessary in cooperation with supervisory authorities of other EU member states, cases of alleged violations of data protection law.

Fill in all required fields in the appropriate form depending on the case/subject-matter of the complaint and attach any documents directly linked to the complaint.

Who can submit a complaint? 

 

The following persons have the right to submit a complaint to the Hellenic DPA:

  • Data subjects, especially if Greece is their habitual residence or place of work, or the place of the alleged infringement. Data subjects have the right to assign non-profit bodies or organizations or unions or associations that legally operate, have statutory goals of general interest and operate in the field of protection of rights and freedoms of data subjects with regard to data protection, to submit a complaint, to the Hellenic DPA, on their behalf.
  • Subscribers or users of e-communication services (regardless if they are natural persons), exclusively for issues concerning violation of the specialized legislation for the processing of personal data in electronic communications, which fall within the competence of the Hellenic DPA.

 

What kind of complaints does the Hellenic DPA examine? 

 

The HDPA examines the following complaints that fall within its competence:

  1. Violation of your rights as data subjects provided for in Articles 15 to 22 of GDPR on condition that you have previously exercised your rights to the controller where they apply, and either you have not received a reply from the controller within the time limit provided for in Article 12(4) GDPR (one month, with a conditional two month extension) or the reply received from the controller is not satisfactory.
  2. Unlawful processing of your personal data in violation of the provisions on the protection of personal data (GDPR, Law 3471/2006 on the protection of personal data in electronic communications). In order to resolve the issue more quickly and/or to provide a fuller documentation of the complaint, it is recommended, before submitting it to the HDPA, to address the controller, possibly exercising your rights.

    Also, the subscriber or user affected (regardless if s/he is a natural person) has the right to submit a complaint to the Hellenic DPA in these cases:
  3. Violation of provisions for conducting phone calls for the promotion of goods or services (Art. 11 (1) and (2) of Law 3471/2006), and
  4. Violations of provisions for sending unsolicited promotional e-mails (Art. 11 of Law 3471/2006), as e-mail and sms.

 

When can I submit a complaint to the DPA? 

 

Before you submit a complaint, you must appeal to the controller, e.g. exercising the rights that are provided for in Articles 15 to 22 of GDPR, where applicable. In case the controller has appointed a Data Protection Officer (DPO), you can contact them for every issue about the processing of your personal data and also for the exercise of your rights. The DPO information is published usually on the website of the controller.

If the issue is not resolved you may submit a complaint to the DPA.

In case the aforementioned procedure is not followed, the DPA might not examine your complaint.

 

Does the Hellenic DPA examine every complaint? 

 

Complaints that are vague, unsubstantiated, are submitted abusively, especially due to a repetitive pattern, are filed anonymously or do not include the required information may be deemed inadmissible (archived) by the Hellenic DPA. Before you submit a complaint, please make sure that you have at least filled in the required fields.

 

To what extent does the DPA examine the complaints? 

 

According to Article 57(1)(f) of GDPR, the DPA investigates, to the extent appropriate, the subject matter of every complaint. Consequently, the extent in which every complaint is examined depends on the DPA’s judgement.

 

Can I ask the DPA to adjudicate compensation in case of a violation? 

 

No. The Hellenic DPA is competent to exercise corrective powers (including fines) to controllers or processors but not to adjudicate compensation to the aggrieved data subjects. In case you seek compensation, you should exercise your rights before a court.

More particularly, according to provisions of Articles 79 and 82 of GDPR, you have the right to

  1. judicial recourse, if you think that your rights have been violated as a result of personal data processing, and
  2. compensation before the competent courts for the damage you have undergone by the controller or the processor, as a result of GDPR violation.

 

How is a complaint submitted?

 

To submit a complaint to the Hellenic DPA you must first log in to the DPA’s online portal and fill in the respective electronic form depending on the subject-matter of the complaint. To log in to the online portal you must use the taxisnet credentials available to complainants who have their habitual residence or place of work in Greece, as well as bodies representing data subjects (Article 80 of GDPR, Article 41 of Law 4624/2019) that are established in Greece. Relevant information on how to submit a complaint in Greek is available here.

In case you cannot log in to the online portal using the taxisnet credentials (because the complainant does not reside or work in Greece, or the representative body does not have an establishment in Greece) and Greece is the place of the alleged infringement, the DPA provides for the submission of complaints in English by e-mail.

In this case, please follow the steps outlined below:

  1. Fill in all required fields in the appropriate form depending on the case/subject-matter of the complaint and attach any documents directly linked to the complaint.

    Complaint form

    Usage

    docx / pdf

    Violation of right (Art. 15 - 22 GDPR)

    docx / pdf

    Unlawful phone calls for the promotion of goods and services

    docx / pdf

    Unsolicited promotional e-mails (email/sms) - SPAM

    docx / pdf

    Unlawful processing (used for every violation that doesn’t fall into any of the three categories above)

    docx / pdf

    Schengen/VIS/Eurodac complaint

     

    In each form there are mandatory fields to be filled in depending on the type of the complaint. If these are not filled in or not filled in correctly, or another form is used in which the required information is not provided, the DPA has the right not to examine the complaint. At the end of each complaint form you can find relevant instructions for completion.

    Complaints submitted that are vague, unsubstantiated, are submitted abusively, especially due to a repetitive pattern, are filed anonymously or do not include the required information, as provided for in the standard complaint forms, may be deemed inadmissible (archived) by the Hellenic DPA.

  2. Send an e-mail with all the attached documents to complaints@dpa.gr.