NIS2 in Greece
Νόμος 5160/2024 - Ενσωμάτωση της Οδηγίας (ΕΕ) 2022/2555 (Οδηγία NIS2)
Law in force since
- Law
- Law 5160/2024
- Authority
- National Cybersecurity Authority
- Classes
- βασικές οντότητες (essential), σημαντικές οντότητες (important)
- Register
- NIS2 self-registration platform
- ISO 27001
- Not named in the law
- Self-check
- NIS2 scope test of the National Cybersecurity Authority
Know when Greece changes its NIS2 rules
- One email when the law, the deadlines or the portal change.
The law
The Law took effect on 2024-11-27, the day it was published in the Gazette. It applies to public and private entities of Annex I and II types that are medium-sized or larger. Some entity types fall under it at any size.
- Name
- Νόμος 5160/2024 - Ενσωμάτωση της Οδηγίας (ΕΕ) 2022/2555 (Οδηγία NIS2)Law 5160/2024 transposing the NIS2 Directive
- Published
- 2024-11-27
- In force
- 2024-11-27
- Text
- Read the Law 5160/2024
Who is in scope
Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.
The Greek law keeps the Directive's size and class rules.
Also note
- The National Cybersecurity Authority is the competent authority, supervisor and single point of contact. Its CSIRT receives incident reports.
- Entities pay a supervision fee and an audit fee. A joint ministerial decision sets the amounts.
- DNS, cloud, data centre, managed service and online platform providers had to send their data under Article 19 by 2025-01-17. A breach carries a fine of up to EUR 200,000.
Registration
Register on the platform. The Law set a 2-month deadline from 2024-11-27. The Authority and the ministers extended it several times, to 2025-09-30 at last. Entities must also give the ICT security officer data. Report changes within 2 weeks.
- Portal
- NIS2 self-registration platform
- Rule
- Fixed deadline
- Deadline
- 2025-09-30
- You need
- Login with the entity's credentials. The form asks for company name, tax number, GEMI number, address, legal representative, services, IP ranges, domain names and the ICT security officer.
- Changes
- Report changes to your data within 14 days
Incident reporting
- 24 hEarly warning
- 72 hIncident notification
- 1 monthFinal reportafter the 72-hour incident notification
Send the reports to the CSIRT of the National Cybersecurity Authority.
Trust service providers give the early notice within 24 hours for incidents that affect their trust services.
Measures and proof
- Essential
- Essential entities face regular and targeted security audits by the Authority. They submit a unified cybersecurity policy to the Authority for approval at least once a year.
- Important
- The Authority acts on important entities when it receives evidence or signs of non-compliance. The Authority can make the policy submission mandatory for them by decision.
The dates, in order
- Law in force
- Management approves the risk measures (3 months after entry into force)Derived from a rule in the law
- Entity registration deadline after the extensions
Duties of management
The management body approves the risk measures, oversees them and answers for breaches. Members of the management body take cybersecurity training. Each entity names an ICT security officer. This role conflicts with the data protection officer role.
Fines
The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.
| Class | Ceiling | At EUR 20m | At EUR 500m | At EUR 2bn |
|---|---|---|---|---|
| Essential | EUR 10m or 2% | EUR 10m | EUR 10m | EUR 40m |
| Important | EUR 7m or 1.4% | EUR 7m | EUR 7m | EUR 28m |
The Law applies the percentage to the worldwide turnover of the undertaking and takes the higher amount. The Authority head decides each fine after a hearing. Breaches of management duties carry a fine of up to EUR 200,000, and breaches of Article 19 up to EUR 200,000. Article 19 covers DNS, cloud, data centre and similar providers.