The Hellenic Data Protection Authority (HDPA, Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) published on November 2, 2026 Decision 19/2026 (Απόφαση 19/2026), dated October 5, 2026, fining Teleperformance Greece, named as ΥΠΗΡΕΣΙΑ 800 ΤΕΛΕΠΕΡΦΟΡΜΑΝΣ ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. ΠΑΡΟΧΗΣ ΥΠΗΡΕΣΙΩΝ, EUR 100,000 as controller of an employee's personal data. Greek BPO and call center operators processing employee data, Greek employers handling employee data subject access requests, Greek HR data controllers and processors with employee data retention obligations, and Greek companies subject to HDPA supervision managing employee personal data must immediately review employee data access request procedures, pre-departure data deletion controls, retention disclosures and Article 32 security measures against the GDPR provisions the HDPA enforced in Decision 19/2026, or face administrative fines under GDPR Article 83, up to EUR 20 million or 4% of global annual turnover. The HDPA split this fine into EUR 60,000 and EUR 40,000.
A former employee complained. The summary finds a missing complete file, a deletion before employment ended while claims were pending, an unexplained extension, no retention period, and missing availability controls. The GDPR is Regulation (EU) 2016/679 governing the processing of personal data of EU residents.
- Authority: Hellenic Data Protection Authority (HDPA)
- Entity: Teleperformance Greece, as controller
- Measure and amount: administrative fines of EUR 60,000 and EUR 40,000, total EUR 100,000, under Article 58(2)(i) GDPR
- Legal basis: Articles 5(1)(a), 5(1)(f), 15 and 17(3)(e) (EUR 60,000); Articles 5(2), 12(3), 13 and 32 (EUR 40,000)
- Decision date: October 5, 2026, published on the HDPA site on November 2, 2026
- Official source: HDPA Decision 19/2026
What happened
The summary on the Decision 19/2026 page lists the five findings: no complete file, unlawful deletion before employment ended while claims were pending, no clear reason for extending the access request, no retention-period notice, and no measures to keep the data available, stop the deletion and handle the requests lawfully. The anonymised text is the PDF of Decision 19/2026. The power used is Article 58(2)(i) GDPR.
The breach
EUR 60,000 covers Articles 5(1)(a), 5(1)(f), 15 and 17(3)(e): the missing file, the deletion, and erasure while data were still required for legal claims. EUR 40,000 covers Articles 5(2), 12(3), 13 and 32: accountability, the unexplained extension, the missing storage-period notice, and availability. The text is on EUR-Lex. Law 4624/2019 (Νόμος 4624/2019) organises the HDPA. The fines cite the GDPR articles.
Who else is in the same regime
Other Greek controllers and processors of employee data sit under the same articles: BPO and call center operators, employers that answer access requests, HR teams that set retention and deletion, and companies the HDPA supervises on employee personal data.
Obsidian tracks 5 regulatory texts (in force, amended or in preparation) for the AI, Data and Digital Governance (AI Act, GDPR, DSA/DMA) industry in Greece, as of November 2026.
What to check now
- On an Article 15 request, send the complete file, and explain any Article 12(3) extension expressly and clearly.
- Stop deletion of an employee file before employment ends while legal claims are pending (Article 17(3)(e)).
- State the storage period, or the criteria for it, in the Article 13 notice given to employees.
- Test the Article 32 measures that keep the file available and that hold a deletion while a request or a claim is open.
- Under Article 5(2), record who authorises a deletion and who answers an access request.
Continuous, per-jurisdiction monitoring surfaces an HDPA decision of this kind the moment the authority publishes it.
