TL;DR
By decision of 28 July 2026, published by the EDPB on 8 October, the Hellenic Data Protection Authority fined the Ministry of Social Cohesion and Family Affairs (controller) €200,000 and E.E.T.A.A. S.A., the local development agency running its systems (processor), €150,000. The Ministry had notified the breach and informed data subjects correctly; the fine concerns system security and the controller-processor relationship. Articles: 25, 28, 32, 33 and 34 GDPR.
What happened
A large-scale cyberattack hit the systems of E.E.T.A.A., used to implement the Ministry's programmes. The databases held data on a very large number of people: identification and contact details, financial data and health data.
What the Authority found
- CORRECT NOTIFICATION. The Ministry, as controller, met its obligations to notify the Authority and inform data subjects (Arts. 33 and 34).
- OUTDATED SYSTEMS. The attack succeeded because E.E.T.A.A. kept using outdated information systems and inadequate security measures, despite knowing the risks (Art. 32).
- UNREGULATED RELATIONSHIP. Shortcomings under Article 28: the controller-processor relationship was not governed as the GDPR requires.
- BOTH FINED. €200,000 for the Ministry and €150,000 for E.E.T.A.A., with an order to sign an Article 28 agreement and complete the planned security measures.
Good notification does not save the controller
Breach handling was correct, yet the controller pays. The reason lies upstream: Article 28 requires using only processors with sufficient guarantees and governing the relationship in writing. A supplier on outdated systems, with no contract binding it, is the controller's risk before it is the supplier's.
What it means for the DPO
Four checks
One: for every supplier processing data on the client's behalf, a signed Article 28 contract, even when the supplier is a public body or a state-owned company. Two: in the contract, minimum security measures and the right to verify them, including system updates. Three: a documented periodic review of suppliers processing health or financial data. Four: if the supplier knows of a risk and does not fix it, the controller must know and decide: that is the moment for a written DPO opinion.
The case is useful for another reason too: it shows that authorities fine the processor directly when the cause of the breach is its own. The processor is not 'covered' by the controller: it has its own security obligations and is liable for them.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
