FREE TOOL · 3 MINUTES

GDPR Check

Twelve questions across the GDPR essentials — records, rights, vendors, security, breaches. Find out which obligations actually apply to you, where you are exposed, and what to fix first. No signup.

Step 1 of 3 · Your processing

What personal data does your business handle?

Your obligations under the GDPR depend on what you process, not just how big you are. In Greece the supervisory authority is the Hellenic Data Protection Authority, and the national implementing law is Law 4624/2019.

Organization size

Fewer than 50 peopleSmall team, probably no dedicated legal or compliance function 50-249 peopleGrowing, with HR and IT but security and privacy sit with someone else 250 or more peopleA full record of processing activities is expected of you by default We are a public authority or bodyMunicipality, ministry, public organisation, school, hospital

Do you handle sensitive data or monitor people systematically?

NoOrdinary customer, supplier and employee data only OccasionallySome health or biometric data, CCTV, or limited profiling Yes, as a core activityHealth, biometric, criminal or similar data at scale, or systematic monitoring and profiling

Step 2 of 3 · The check

Twelve questions across the GDPR essentials

These are the areas the Hellenic Data Protection Authority actually looks at - and where fines and complaints most often originate. Your answers stay in your browser.

Step 3 of 3 · Your result

Want this as a written report?

We will email you your score, the obligations that apply to you and your priority actions - in plain language you can act on. No sales sequence.

Our compliance services

This is an indicative self-assessment, not legal advice, and it does not replace a data protection audit or the advice of a qualified lawyer. Infringements can attract fines of up to 20 million EUR or 4% of global annual turnover, whichever is higher. The Hellenic Data Protection Authority publishes official guidance at dpa.gr.

WHY IT MATTERS

Most GDPR trouble starts small

Rarely does an authority arrive unannounced. It usually starts with one complaint — and then everything you do with personal data comes under scrutiny.

One complaint is enough

An unanswered erasure request or an unwanted marketing email is all it takes to open a file on your organization.

You must prove it, not just do it

The GDPR places the burden of proof on you. Without records, doing the right thing is impossible to demonstrate.

Compliance rests on security

Article 32 turns your technical controls into a legal obligation — which is exactly where we can help.

Turn the gaps into a plan

We help organizations in Greece build GDPR compliance that holds up — records, procedures and the technical measures behind them.