Data Protection and Privacy
Personal data has become an integral part of modern business, while privacy remains a fundamental right. As organisations collect, process, store and share increasing volumes of information, the legal responsibilities surrounding that information have become more complex. Data protection is no longer simply a matter of regulatory compliance; it influences how businesses operate, develop products, manage relationships and maintain the trust of their customers, employees and partners.
We advise businesses, organisations and individuals on all aspects of data protection and privacy, combining regulatory expertise with an understanding of the commercial and technological environments in which personal information is processed. Our work encompasses the General Data Protection Regulation (GDPR), Greek data protection legislation, the ePrivacy framework and other applicable European and national requirements, helping clients establish appropriate safeguards while pursuing their operational and commercial objectives.
Compliance requires more than preparing a privacy policy. We assist organisations in developing and implementing comprehensive data protection frameworks, including privacy notices, internal policies, records of processing activities, data retention procedures, consent mechanisms and arrangements governing relationships between controllers, processors and third parties. We also advise on data protection impact assessments, legitimate interest assessments, accountability obligations and the implementation of privacy by design and by default.
The lawful collection and use of personal data raises important questions across virtually every business activity. We advise on employee and workplace data, customer information, marketing and advertising, cookies and online tracking, surveillance and monitoring, profiling and automated decision-making. Particular attention is given to the processing of sensitive personal data, including health information, and to activities involving children or other individuals requiring additional protection.
International data flows present further challenges. We assist clients with cross-border transfers of personal data, including transfers outside the European Economic Area, the use of Standard Contractual Clauses, transfer impact assessments and contractual arrangements with international service providers. We also advise on data-sharing agreements, outsourcing, cloud services and other commercial relationships involving access to or processing of personal information.
Technology and innovation are increasingly shaping the development of privacy regulation. Artificial intelligence, automated systems, digital platforms and data-driven business models create new opportunities but also raise questions concerning transparency, lawful processing, accountability and individual rights. We advise businesses developing or deploying these technologies on the privacy implications of their products and services, helping them address data protection requirements from the development stage rather than after implementation.
Privacy and data protection also play an increasingly important role in media and communications. The publication and dissemination of personal information through newspapers, television, digital platforms and social media can raise difficult questions concerning the boundaries between freedom of expression, the public interest and the right to privacy. We advise publishers, media organisations, content creators, businesses and individuals on the lawful use and publication of personal information, including matters involving image and personality rights, journalistic activities, online publications, targeted advertising and the disclosure of private or sensitive information. We also assist individuals in protecting their privacy against unlawful publication, intrusive practices and the unauthorised use of their personal information or likeness, including by seeking the removal of content and pursuing appropriate legal remedies.
We also assist organisations in responding to personal data breaches and other incidents involving the loss, unauthorised disclosure or misuse of information. Our work includes assessing notification obligations, communicating with supervisory authorities and affected individuals, reviewing contractual responsibilities and managing potential regulatory and civil liability. Where investigations or complaints arise, we represent clients before the Hellenic Data Protection Authority and in related administrative or judicial proceedings.
Privacy rights are equally important to individuals. We advise on the exercise and enforcement of data subject rights, including access, rectification, erasure, restriction, objection and data portability. We also represent individuals whose personal information has been unlawfully collected, disclosed, published or otherwise processed, including matters involving misuse of personal data, intrusive monitoring and interference with private life.
Data protection and privacy frequently intersect with employment, commercial contracts, intellectual property, cybersecurity and broader regulatory obligations. We consider these connections when advising clients, recognising that effective compliance must be integrated into an organisation's operations rather than treated as a separate administrative exercise.
Our objective is to help organisations use information responsibly and lawfully while protecting the rights of the individuals to whom it relates. We believe that sound data protection practices should provide legal certainty, support innovation and strengthen the trust on which lasting professional and commercial relationships depend.