Data Privacy & Cybersecurity.

A DPO is mandatory under the GDPR for public authorities, and for any organisation whose core activities involve large-scale, regular and systematic monitoring of individuals, or large-scale processing of special category data. Many businesses that fall outside the strict legal requirement still appoint one — or retain external DPO advisory support — because the function forces the documentation and oversight a compliance programme needs anyway. We assess whether the requirement applies to you, and can act as, or advise, your DPO under a -accredited mandate either way.

A Data Protection Impact Assessment (DPIA) is a structured process for identifying and mitigating data protection risk before a processing activity begins. It is legally required whenever processing is likely to result in a high risk to individuals' rights — large-scale profiling, systematic monitoring, processing of special category data at scale, or deploying new technology with uncertain privacy implications are typical triggers. Skipping a required DPIA is itself a compliance failure, independent of whether anything subsequently goes wrong with the processing itself. We run the assessment and document it to a standard that holds up if the HDPA asks to see it.

Where a breach is likely to result in a risk to individuals, the GDPR requires notification to the HDPA within 72 hours of the organisation becoming aware of it, describing the nature of the breach, the likely consequences and the measures taken or proposed. Where the risk to individuals is high, they must also be notified directly, without undue delay. The 72-hour clock does not pause for internal investigation, and organisations without a tested breach response plan routinely miss it or file an incomplete notification. We help build the plan in advance and manage the notification and any follow-on HDPA correspondence when a breach actually occurs.

Very likely yes, if you meet the applicable size thresholds. NIS2 significantly expanded the scope of EU cybersecurity regulation beyond traditional critical infrastructure — its "essential" and "important" entity categories now capture digital infrastructure and service providers, manufacturing, postal and courier services, waste management, food production and a range of mid-sized companies that never previously considered themselves regulated on cybersecurity. We assess whether your organisation and sector fall within scope, and if so, implement the risk-management measures and incident reporting duties NIS2 requires.

Yes — representation before the Hellenic Data Protection Authority in complaints, audits and formal investigations is a core part of the practice, drawing on direct experience liaising with the HDPA while designing and running a pan-European GDPR compliance programme in-house. That includes preparing the organisation's submissions and evidence, managing correspondence and deadlines, and, where a decision or corrective order results, advising on next steps. Early engagement — before a position is locked in on paper — generally produces a materially better outcome than responding after the fact.

Very likely yes, if you meet the applicable size thresholds. NIS2 significantly expanded the scope of EU cybersecurity regulation beyond traditional critical infrastructure, now capturing digital infrastructure providers, manufacturing, postal services, waste management and many mid-sized companies. We assess whether your organisation and sector fall within scope and implement the measures NIS2 requires.

Yes, representation before the Hellenic Data Protection Authority in complaints, audits and formal investigations is a core part of the practice, drawing on direct experience liaising with the HDPA while designing and running a pan-European GDPR compliance programme in-house. Early engagement generally produces a materially better outcome than responding after the fact.