VPNs with servers in Greece

Decision 19/2024 of the Hellenic Data Protection Authority ordered a mobile operator to give a data subject access to the metadata held on him and recognised the current framework as problematic. Whether a VPN operator is a provider of electronic communications services within these laws is not established.

The Hellenic Gaming Commission keeps a list of unlicensed gambling sites that internet providers are directed to block; about 11,000 domains were reported blocked by December 2025. Under Article 66E of the Copyright Law (2121/1993, added by Law 4481/2017), a committee has acted since September 2018 and can order providers to block domain names that a rights holder names.

Article 191 of the Penal Code, rewritten in November 2021, punishes spreading false news, publicly or online, that is capable of causing concern or fear to the public and of undermining confidence in the national economy, the country’s defence capacity or public health.

According to Human Rights Watch, the base penalty is imprisonment of at least three months and a fine; repetition through the press or online carries at least six months. The text does not define false news and does not require actual harm.

In 2024 the Council of State (decision 465/2024) held invalid a provision of Law 4790/2021 that forbade informing a person put under national-security surveillance even where no risk arose, calling it an excessive and disproportionate restriction, under EU privacy law and the Charter.

On 2 March 2026 its full bench postponed its final judgment and ordered the intelligence service to produce a journalist’s surveillance file or explain on what legal ground it was destroyed. The Hellenic Authority for Communication Security and Privacy, set up under Law 3115/2003 and Article 19(2) of the Constitution, audits providers and the intelligence service.

In 2026 a Greek court sentenced four executives of the company behind the Predator spyware to prison over its use against public figures in Greece, Citizen Lab reports. The order of the rows is the security score, and a server’s location is not a recommendation.