NIS2 obligations in Greece

Competent authority & CSIRT Legal ref: Art.3

• Ministry of Digital Governance. ecs-org.eu · 28 Oct 2026 · secondary source
• National Cybersecurity Authority. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 3, Annex I, II

• NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• Exclusions are limited to law enforcement government agencies only, as well as certain entities that are already under exclusion from the (ΕU) 2022/2554 directive by the Greek government. ecs-org.eu · 28 Oct 2026 · secondary source

Registration

• (Legal reference: Art. 19 + Link; Art 4, 19 + Link) ecs-org.eu · 28 Oct 2026 · secondary source
• Entities are required to submit to the National Cybersecurity Authority the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification, as well as the type of entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details of the entity and its legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services . ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services (if applicable). ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Domain Names of Company. ecs-org.eu · 28 Oct 2026 · secondary source
• The law defines two distinct groups of applicable companies. Companies under Article 19, such as DNS/TLD providers, online marketplaces, online search engines, social networks, data centre & network providers, security service providers, need to follow a stricter process for keeping registration information up to date. ecs-org.eu · 28 Oct 2026 · secondary source
• Joint Ministerial Decision 1645/2025 from 15/04/2025 extended registration deadlines to 30/05/2025 for all types of entities. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities should register through the dedicated registration platform accessible via this link ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Link · Link · link

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 16

• Incidents are reported to the National CSIRT (of the National Cybersecurity Authority). ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

• The law includes provisions regarding the Chief Information Security Officer (CISO) role, including avoiding potential conflicts of interest between CISOs and Data Protection Officers (DPOs). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 26

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Additional administrative fines are defined for breaches of specific paragraphs of Article 24. Depending on the type of breach, these can range between 20,000 and 800,000 EUR in addition to the standard fines. These fines could concern failures to comply with registration deadlines (up to 200,000 EUR), notification of authorities (up to 100,000 EUR), audits (up to 500,000 EUR, essential and up to 350,000 EUR, important), use of required technology (up to 300,00 EUR) or training (up to 100,000 EUR). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 17

• Reference to EU standards under the NIS2 Directive. ecs-org.eu · 28 Oct 2026 · secondary source
• Greece requires structured, risk-based assessments covering IT/OT systems, supply chain, and personal data environments. Reviews are mandatory annually or after major changes. Entities must register and submit compliance declarations. Audits are planned from Q4 2025 under the National Cybersecurity Authority. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text · Joint Ministerial decision · Joint Ministerial decision

What changed recently

No dated changes recorded.