Compliance Guide — Greece
Employee Monitoring Laws in Greece: Hellenic DPA Requirements and GDPR Compliance 2026
Employee monitoring laws in Greece are governed by the EU General Data Protection Regulation (GDPR), Law 4624/2019 — Greece's national GDPR implementation statute — and enforcement guidance from the Hellenic Data Protection Authority (HDPA, known in Greek as the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα or APDPCH). Greece additionally anchors data protection in Article 9A of its Constitution, a fundamental right to personal data protection inserted in the 2001 constitutional revision. This guide covers every layer of Greek monitoring law: the HDPA's enforcement record, CCTV restrictions, email monitoring rules, employee representative consultation obligations, DPIA requirements, and a practical compliance checklist for employers operating in Greece in 2026.
7-day free trial. No credit card required.
What Legal Framework Governs Employee Monitoring in Greece?
Employee monitoring laws in Greece rest on four interlocking layers: EU law, national statute, constitutional protection, and HDPA enforcement guidance. Understanding how they interact is the foundation of a compliant monitoring program.
GDPR — The Directly Applicable EU Baseline
The General Data Protection Regulation (GDPR) applies directly in Greece without requiring domestic transposition. Every monitoring activity that collects personal data — activity logs, screenshots, email metadata, location data — triggers GDPR obligations. The primary lawful bases Greek employers rely on for monitoring are:
- Article 6(1)(b) — Contract necessity: Processing necessary to perform or manage the employment contract. Covers attendance tracking, timesheets, and productivity data used for performance management.
- Article 6(1)(c) — Legal obligation: Processing required to comply with Greek labor law or sector-specific regulations. Covers mandatory attendance records and health and safety monitoring.
- Article 6(1)(f) — Legitimate interest: Processing necessary for the employer's legitimate interests, provided they are not overridden by employee fundamental rights. This is the most commonly cited basis for productivity monitoring and network security monitoring. A balancing test is required.
Employee consent under Article 6(1)(a) is technically available but strongly discouraged by the HDPA as a primary basis, because the inherent power imbalance in employment relationships makes genuinely free consent difficult to establish.
Law 4624/2019 — Greece's National GDPR Implementation
Law 4624/2019 (Gazette Α' 137/29.8.2019) transposes GDPR into Greek law and exercises the employment-specific derogations available under GDPR Article 88. Key provisions for employers include:
- Employee personal data may be processed when necessary for the establishment, exercise, or fulfilment of rights and obligations arising from the employment relationship — without requiring individual consent in each instance.
- Data processing for performance assessment or disciplinary purposes must be based on documented operational necessity and communicated to employees in advance.
- Employee representative bodies (works councils, trade union representatives) must be informed before implementing monitoring systems, providing them an opportunity to raise objections through labor relations channels.
- Data Protection Officers (DPOs) are mandatory for organisations engaged in large-scale, systematic employee monitoring — not just public bodies.
The law also incorporates GDPR Article 88's requirement that national rules include "suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights." The HDPA references this standard in enforcement decisions involving disproportionate workplace monitoring.
Greek Constitution Article 9A
The right to personal data protection is enshrined in the Greek Constitution at Article 9A, added during the 2001 revision. This constitutional anchor means Greek courts apply heightened scrutiny to employer monitoring. In labor disputes, courts have used Article 9A to exclude evidence obtained through monitoring that violated employee privacy — even where the employer technically complied with procedural GDPR requirements. Proportionality is not merely a regulatory concept in Greece; it is a constitutional demand.
Law 3471/2006 — Privacy in Electronic Communications
Law 3471/2006, implementing the EU's 2002 ePrivacy Directive, governs employer monitoring of company networks and electronic communications. The law permits employers to monitor company network traffic and communications systems for security and operational purposes, but draws a clear line between metadata-level monitoring (who communicated, volume, timing) and content-level interception (reading message bodies). Content monitoring requires specific documented justification and prior employee notice.
Greek Labor Law — Employee Representative Consultation
Presidential Decree 156/94 and Labor Law 3863/2010 require employers to inform and consult with employee representative bodies before introducing technological monitoring systems into the workplace. Unlike Germany's Betriebsrat model — where the works council has blocking power — Greek law creates a consultation obligation without an absolute veto right. However, failure to consult is an independent violation that strengthens HDPA complaints and labor court claims. Collective agreements in sectors such as banking, telecoms, and the public sector may negotiate stricter requirements.
How Actively Does the HDPA Enforce Employee Monitoring Rules?
The Hellenic Data Protection Authority is not a passive regulator. It investigates complaints, conducts own-initiative audits, and has imposed fines on employers across multiple monitoring contexts. Three enforcement patterns illustrate the HDPA's approach.
CCTV Enforcement — Decision 1/2011 and Its Legacy
HDPA Decision 1/2011 remains the foundational framework for workplace CCTV in Greece. The decision established that camera systems cannot blanket-monitor all work areas. Permissible zones include building entrances and exits, cash handling areas, warehouses with valuable stock, and server rooms. Cameras aimed at ordinary work areas — desks, workstations, open-plan seating — violate the proportionality principle unless a specific, documented security justification exists. In the years following Decision 1/2011, the HDPA has fined multiple employers for camera placements that continuously monitored employees performing routine work tasks. Fines in recorded CCTV cases have ranged from approximately 5,000 euros for small businesses to over 150,000 euros for larger organisations.
Mandatory requirements under the HDPA's CCTV framework include:
- Visible signage notifying employees and visitors that CCTV is in operation
- Written employee notice before system activation
- Footage deletion within 15 calendar days unless an incident has been captured and preserved for investigation
- Access limited to named, authorised personnel with a documented access log
- DPIA completed before installation if the system covers large areas or multiple locations
COVID-Era Remote Monitoring Guidance — Precedent for 2026
During the COVID-19 pandemic, the HDPA issued guidance on remote employee monitoring that has not been rescinded and establishes important precedents for hybrid and remote work in 2026. The HDPA's position includes:
- Employers may not activate employee webcams to monitor home working environments. Webcam snapshots of home spaces capture third-party personal data (family members) without a lawful basis.
- Screen monitoring for remote workers must be limited to work applications during designated work hours. Capturing personal application activity or activity outside work hours is unlawful.
- Any processing of health data collected through remote monitoring requires explicit consent under GDPR Article 9(2)(a) and is subject to additional conditions under Law 4624/2019.
- Monitoring on personal devices requires a separate, documented legal basis and employee notification — the employment contract alone is insufficient.
These positions directly inform how eMonitor should be configured for Greek employees working remotely: activity tracking should operate only during declared work hours, and personal application categories should be excluded from productivity classification.
Email and Digital Communications Enforcement
The HDPA has enforced the distinction between permissible metadata monitoring and impermissible content interception under Law 3471/2006. In investigations involving employer access to employee email inboxes — including one case involving a Greek financial institution — the HDPA found that accessing email content without prior written policy notice and specific documented justification violated both the ePrivacy framework and GDPR Article 5's transparency principle. Employers in Greece should treat email content monitoring as requiring a written policy, employee acknowledgment, and proportionality documentation — not merely a general network monitoring policy.
Key Enforcement Statistic: The HDPA received over 1,400 data protection complaints in 2023, of which a significant portion involved workplace monitoring disputes. Greek employers face a regulator that is resourced, active, and willing to impose fines proportionate to organisational size — including fines that reach into six figures for systematic violations.
Which Monitoring Practices Are Permitted — and Which Are Restricted?
Not all monitoring is equally permissible under Greek law. The HDPA applies a proportionality and necessity test to each monitoring type, and different practices face different scrutiny levels.
| Monitoring Type | Permissibility | Key Requirements |
|---|---|---|
| Application and website usage tracking | Generally permitted | Written policy; work-hours-only; employee notice |
| Automated time and attendance logging | Permitted | Employee notice; proportionate retention period |
| CCTV in entrance/security zones | Permitted with conditions | Decision 1/2011 requirements; signage; 15-day deletion |
| CCTV of ordinary work areas | Restricted | Only with specific security justification; proportionality assessment |
| Email metadata monitoring | Permitted for security | Written policy; Law 3471/2006 compliance |
| Email content review | Restricted | Specific documented justification; prior written notice |
| Periodic screenshots (work hours) | Permitted with DPIA | DPIA required; employee notice; proportionate frequency |
| Continuous screen recording | Restricted | DPIA required; strong justification; limited access |
| Keystroke activity intensity | Permitted with conditions | Activity intensity only; no content capture; disclosure required |
| Location tracking (on company premises) | Permitted with notice | Written policy; proportionate scope |
| Location tracking (outside premises) | Restricted | Field roles only; strong justification; separate DPIA |
| Personal device monitoring | Highly restricted | Separate legal basis; explicit policy; DPIA |
| Webcam monitoring (home environment) | Not permitted | Captures third-party home data; HDPA guidance prohibits |
| Health data collection via monitoring | Not permitted without explicit consent | Article 9 GDPR; explicit consent under Law 4624/2019 |
When Does Greek Law Require a Data Protection Impact Assessment?
A Data Protection Impact Assessment (DPIA) under GDPR Article 35 is not optional for systematic employee monitoring in Greece. The HDPA has confirmed that the following monitoring activities are high-risk and require a DPIA before deployment:
- Systematic screen capture or recording — Any monitoring system that captures employee screens at regular intervals or on a continuous basis
- Keystroke and mouse activity monitoring — Systems that measure input activity patterns at the individual level on an ongoing basis
- Systematic email and communications content review — Automated or manual review of employee message content at scale
- CCTV covering substantial portions of a workplace — Camera systems that capture employee activity across large work areas or multiple floors
- Location tracking beyond the workplace — GPS or device location monitoring that extends to employee movements outside company premises
- Automated profiling for performance assessment — Any system that uses monitoring data to generate individual employee performance scores without human review at the individual level
A compliant DPIA must document: the nature, scope, context, and purposes of the processing; the necessity and proportionality of the monitoring relative to its purpose; the risks to employee rights and freedoms; and the safeguards implemented to address those risks. The HDPA must be consulted if the residual risk after safeguards remains high.
Under Law 4624/2019, organisations engaged in systematic employee monitoring are also required to designate a Data Protection Officer (DPO) if they have not already done so under GDPR Article 37. The DPO must review and sign off on DPIAs for new monitoring systems before deployment.
What Is the Employee Representative Consultation Requirement?
Greek labor law requires employers to inform and consult with employee representative bodies before introducing monitoring systems. This obligation arises from Presidential Decree 156/94, Labor Law 3863/2010, and is reinforced by Law 4624/2019's employment data provisions.
Who Must Be Consulted?
The consultation obligation applies where any of the following representative structures exist at the workplace:
- Works councils (Συμβούλια Εργαζομένων): Mandatory in workplaces with 50 or more employees under Law 1767/1988
- Health and safety committees (Επιτροπές Υγιεινής και Ασφάλειας): Required in workplaces with 50 or more employees; monitoring systems affecting work conditions fall within their scope
- Trade union representatives: Where sector or enterprise collective agreements give union representatives information rights over technology deployment
For smaller employers without formal representative structures, Law 4624/2019 still requires employee notification — meaning all employees must receive written information about the monitoring system before it becomes operational, even if no formal consultation body exists.
What Does Consultation Involve?
Consultation is not a simple notification exercise. Employee representatives are entitled to receive a description of the monitoring system including its technical capabilities, the categories of data collected, who has access, retention periods, and the employer's documented justification. Representatives have a reasonable period — typically 15 to 30 days — to review the documentation, ask questions, and raise concerns. While the works council does not have a German-style veto right, objections must be documented, and the employer should address them or provide written reasoning for proceeding despite objections.
Collective agreements in specific sectors, particularly banking, telecommunications, and the broader public sector, may negotiate additional rights including co-determination over monitoring scope or employee access to their own monitoring data beyond the statutory GDPR minimum.
What Data Retention Limits Apply to Monitoring Data in Greece?
GDPR Article 5(1)(e) requires that personal data be kept no longer than necessary for the purposes for which it was collected — the storage limitation principle. For employee monitoring data in Greece, the HDPA has not issued a single universal retention period but has established sector guidance and applied proportionality principles in enforcement decisions.
HDPA Position on Retention Periods
In CCTV enforcement, HDPA guidance and Decision 1/2011 set a 15-day default deletion period for CCTV footage absent an incident. For digital monitoring data such as activity logs, application usage records, and screenshot repositories, the HDPA applies a proportionality analysis: retention must not exceed what is necessary to serve the stated monitoring purpose. Routine productivity monitoring data held for more than three months without a specific justification risks challenge.
Recommended Retention Approach
- Real-time and daily activity logs: 30 to 90 days for routine operational purposes
- Timesheet and attendance records: 5 years minimum under Greek labor law record-keeping requirements (consistent with GDPR contract necessity basis)
- Screenshot repositories: 30 days for routine screenshots; longer only if specific incidents require preservation with documented justification
- CCTV footage: 15 days per HDPA guidance; up to 30 days for documented security-critical areas with written justification
- Incident investigation data: Duration of the investigation plus applicable legal proceedings period, documented in a retention schedule
Retention periods must be communicated to employees in the workplace privacy notice and incorporated into the DPIA for systematic monitoring. Automated deletion controls — not manual processes — are the HDPA-preferred approach to ensuring compliance with stated retention periods.
How Does eMonitor Support HDPA Compliance for Greek Employers?
Greek employers deploying employee monitoring software need a system whose architecture aligns with HDPA requirements rather than one that creates additional compliance risks. eMonitor is configured for GDPR-aligned operation by default, with specific settings that address Greek law's proportionality and transparency demands.
Work-Hours-Only Monitoring
eMonitor tracks employee activity only during declared work sessions — not before clock-in or after clock-out. This architecture directly satisfies the HDPA's guidance that remote monitoring must be limited to work hours, and ensures the system does not capture personal activities during non-work periods. For Greek remote workers, this is a foundational compliance requirement, not an optional feature.
Employee-Visible Dashboards
Each employee has access to their own monitoring data through a personal dashboard showing activity logs, application usage, and time records. This transparency mechanism satisfies GDPR Articles 12-15 transparency obligations and addresses the HDPA's emphasis on employee awareness. When employees can see what is collected, monitoring becomes a tool for self-improvement rather than covert surveillance — the distinction the HDPA consistently draws in enforcement decisions.
Screenshot Frequency Controls
eMonitor's screenshot frequency is fully configurable — from disabled entirely to periodic intervals aligned with the employer's DPIA-documented justification. For Greek employers, configuring screenshots at lower frequencies (every 30 to 60 minutes for roles with documented justification, or disabling for standard knowledge worker roles) is the proportionality-compliant approach.
Data Retention Automation
Configurable automated deletion schedules ensure monitoring data is purged at the intervals specified in the employer's privacy notice and DPIA. Automated deletion is more defensible to the HDPA than manual deletion processes, which are difficult to evidence consistently. eMonitor supports per-data-category retention periods — allowing, for example, 90-day retention for activity logs while maintaining 5-year retention for timesheet records.
Access Controls and Audit Logs
Role-based access controls limit who can view individual employee monitoring data. All access to monitoring records is logged with timestamps and user identities — creating the audit trail the HDPA expects to see when investigating complaints. Only named, authorised managers and HR personnel can access individual monitoring data; general managers cannot access data for teams they do not supervise.
eMonitor is trusted by 1,000+ companies across 50+ industries, rated 4.8/5 on Capterra, and priced from $3.50/user/month — making HDPA-compliant monitoring accessible without the enterprise budget. See how it compares to alternatives on our employee monitoring software comparison page, or review the complete GDPR compliance guide that underpins Greek law requirements.
Greek Employer HDPA Compliance Checklist for 2026
Use this checklist to assess your organisation's readiness before deploying or reviewing employee monitoring systems in Greece. For each item, document your completion with dated evidence.
- Identify the lawful basis — Document which GDPR Article 6 basis applies to each monitoring activity. Most employers use Article 6(1)(b) for attendance/timesheets and Article 6(1)(f) for productivity monitoring, with a documented legitimate interest assessment for the latter.
- Conduct a DPIA — If the monitoring is systematic (screenshots, keystroke intensity, CCTV), complete a DPIA under GDPR Article 35 before deployment. Involve your DPO.
- Update the employee privacy notice — Ensure the notice includes: categories of data collected; purposes and legal basis; who has access; retention periods; employee rights; and HDPA contact details.
- Consult employee representatives — Provide the works council, health and safety committee, or union representatives with documented information about the monitoring system and a reasonable period to respond before activation.
- Configure work-hours-only operation — Ensure monitoring software is activated only during declared work sessions. Document this configuration in the DPIA and employee notice.
- Set and automate data retention — Configure automated deletion schedules aligned with your stated retention periods. Document retention logic per data category.
- Restrict data access — Implement role-based access controls. Maintain an access log. Ensure only authorised personnel can access individual employee monitoring data.
- Review CCTV compliance — Audit camera positions against HDPA Decision 1/2011. Remove or reposition cameras covering ordinary work areas without specific documented justification. Confirm 15-day deletion cycle.
- Document email monitoring policy — If email metadata or content monitoring is in place, ensure a written policy exists, employees have acknowledged receipt, and the scope is proportionate and documented.
- Establish an employee rights procedure — Create a documented process for handling GDPR access requests, objections, and erasure requests from employees within the statutory response periods (generally 30 days under GDPR Article 12).
Download a pre-populated version of this checklist in the eMonitor policy template library, which includes Greek law-specific clauses for employment contracts and employee privacy notices.
How Does Greece Compare to Other EU Jurisdictions on Monitoring Restrictions?
Greek employers operating across EU borders frequently ask how HDPA requirements compare to those in other member states. The short answer is that Greece sits in the moderately strict tier — more demanding than Ireland or the Netherlands in practice, but less restrictive than Germany or France.
Greece vs. Germany
Germany's co-determination system through the Betriebsverfassungsgesetz gives works councils absolute blocking power over monitoring technology deployment — employers cannot lawfully proceed if agreement is not reached, and must escalate to binding arbitration. Greek works councils hold consultation rights without veto power. See the Germany employee monitoring compliance guide for full detail on Betriebsrat requirements.
Greece vs. France
France's CNIL requires formal prior consultation with employee representatives (CSE) and, for some monitoring categories, prior declaration to the CNIL. The French approach to email monitoring is more restrictive than Greece's in that courts have developed strong employee email privacy protections through case law. See the France employee monitoring guide for comparison.
Greece vs. EU GDPR Baseline
Greek constitutional protection under Article 9A adds a layer of judicial scrutiny that pure GDPR jurisdictions lack. Employers who meet GDPR's minimum requirements may still face successful legal challenges in Greek courts if their monitoring practices are found disproportionate under constitutional standards. This is a practical reason why proportionality documentation — not just lawful basis identification — is essential in Greece. Review the GDPR employee monitoring compliance guide for the EU baseline that Greek law builds on.
For organisations deploying monitoring across multiple European jurisdictions, the EU AI Act employee monitoring guide covers the additional obligations introduced for AI-powered monitoring systems operating in the EU from 2025 — obligations that apply to Greek employers using automated activity scoring or behavior analytics.
Frequently Asked Questions: Employee Monitoring Laws in Greece
Can Greek employers monitor employees?
Yes. Greek employers may monitor employees when a lawful basis exists under GDPR Article 6 — most commonly legitimate interest (Article 6(1)(f)) or contract necessity. Employers must inform employees through a written workplace policy before monitoring begins, consult employee representatives where required, conduct a DPIA for systematic monitoring, and ensure monitoring is proportionate to the stated purpose. The HDPA actively investigates complaints and has fined employers for monitoring without prior notice.
What is the Hellenic DPA (HDPA) and what powers does it have?
The Hellenic Data Protection Authority (HDPA — APDPCH) is Greece's independent supervisory authority under GDPR Article 51. It has the power to investigate complaints, conduct audits, issue binding orders, impose administrative fines up to 20 million euros or 4% of global annual turnover, and refer cases for criminal prosecution. The HDPA has issued formal guidance on CCTV in workplaces and has fined employers for unlawful camera monitoring of employees.
What does Law 4624/2019 require for employee monitoring?
Law 4624/2019 implements GDPR into Greek law and supplements it for employment contexts. Key provisions include: employee data may be processed when necessary for the employment relationship without individual consent each time; processing for performance assessment or disciplinary purposes must be documented; employee representative bodies must be informed before monitoring systems are implemented; and DPOs are required for organisations engaged in systematic employee monitoring.
Does Greek law require informing employee representatives before monitoring?
Yes. Under Law 4624/2019 and Greek Labor Law (Presidential Decree 156/94 and Law 3863/2010), employers must inform works councils and employee representatives before introducing monitoring systems. While Greek co-determination rights are less absolute than Germany's works council blocking power, failure to consult employee representatives is an independent compliance violation that can support HDPA complaints and labor court claims.
What does HDPA Decision 1/2011 say about CCTV in the workplace?
HDPA Decision 1/2011 is the foundational guidance on workplace CCTV in Greece. It established that cameras cannot cover all work areas — monitoring must be limited to specific justified zones such as cash registers, entrances, and server rooms. Cameras aimed at desks or ordinary workspaces violate proportionality. Employers must post visible signage, notify employees in writing, and delete footage within 15 days unless an incident has been recorded. The HDPA has issued multiple fines for non-compliant camera placements since this decision.
Can Greek employers monitor employee email?
Greek employers may monitor company email systems for security and operational purposes under Law 3471/2006. However, monitoring email content — reading message bodies — requires specific documented justification beyond general security. Employers must notify employees of the monitoring policy before implementation. The HDPA distinguishes between metadata monitoring, which is more permissible, and content monitoring, which requires stronger justification and a proportionality assessment.
When is a DPIA required for employee monitoring in Greece?
A DPIA under GDPR Article 35 is required in Greece whenever employee monitoring is systematic, large-scale, or involves special categories of data. The HDPA has confirmed the following activities require a DPIA: continuous screen capture or recording; keystroke activity monitoring; systematic email content review; CCTV covering large workplace portions; and location tracking outside the workplace. The DPIA must document processing purposes, necessity, proportionality, and safeguards.
What employee rights apply to monitoring data in Greece?
Employees in Greece retain full GDPR data subject rights: access to monitoring data (Article 15); rectification (Article 16); erasure where the legal basis no longer applies (Article 17); restriction of processing (Article 18); and the right to object to processing based on legitimate interest (Article 21). Employees may file complaints directly with the HDPA without first approaching their employer. The HDPA processes complaints within statutory timeframes.
Does Article 9A of the Greek Constitution affect employer monitoring?
Yes. Article 9A of the Greek Constitution establishes a fundamental right to personal data protection. This constitutional guarantee means Greek courts apply heightened scrutiny to employer monitoring. Courts have cited Article 9A in labor disputes to exclude evidence obtained through monitoring that violated employee privacy — even where GDPR procedural requirements were technically met. Proportionality is a constitutional demand in Greece, not merely a regulatory one.
What are the maximum fines the HDPA can impose for unlawful monitoring?
The HDPA can impose fines on two tiers. Lower-tier violations carry fines up to 10 million euros or 2% of global turnover. Higher-tier violations (unlawful processing, no legal basis) carry fines up to 20 million euros or 4% of global turnover. For smaller Greek employers, the HDPA has historically issued proportionate fines in the range of 5,000 to 150,000 euros for CCTV and unlawful monitoring violations.
How does Greece compare to France and Germany on monitoring restrictions?
Greece sits between France and Germany in monitoring strictness. Germany's Betriebsrat system gives works councils absolute blocking power. France requires formal employee representative consultation and CNIL oversight for certain monitoring practices. Greece requires consultation without a veto right. The HDPA is comparably active to France's CNIL. Greek constitutional protections under Article 9A add judicial scrutiny absent in many EU jurisdictions.
What practical steps should Greek employers take before deploying monitoring software?
Greek employers should complete six steps before deploying any monitoring system: identify and document the lawful basis under GDPR Article 6; conduct a DPIA for systematic monitoring; update the employee privacy notice to include monitoring details; consult works councils or employee representatives as required by Law 4624/2019; configure the software to collect only minimum necessary data with appropriate retention limits; and ensure only authorised personnel can access monitoring data with access logs maintained.
Related Compliance Guides
GDPR Employee Monitoring
The EU-wide baseline that underpins Greek law. Complete GDPR compliance guide for employee monitoring across all 27 member states.
Read guide →Germany Employee Monitoring Laws
How Germany's Betriebsrat co-determination system gives works councils blocking power over monitoring technology.
Read guide →France Employee Monitoring Laws
CNIL requirements, CSE consultation obligations, and French-specific restrictions on email and digital communications monitoring.
Read guide →Also relevant: EU AI Act and employee monitoring · Employee monitoring policy template
Legal Disclaimer
The information on this page is provided for general informational purposes only and does not constitute legal advice. Employee monitoring law in Greece is subject to change through HDPA guidance, court decisions, and legislative amendments. Employers should consult qualified Greek legal counsel and a Data Protection Officer before implementing any employee monitoring program. This guide reflects publicly available information as of April 2026 and is not a substitute for professional legal advice specific to your organisation's circumstances.