Personal Data

Art. 4 (1) of the GDPR states that personal data reveal information about an identified or identifiable natural person. Personal data include an individual’s name, a picture, a phone number, even a professional phone number, a code, a bank account number, an e-mail address, a fingerprint, etc.

Please visit:


Special Category of personal data

‘Special category of personal data’ means personal data revealing racial or ethnic origin, political opinions, religious, moral or philosophical beliefs, trade union affiliation or membership and data concerning health, sex life or judicial information. It also refers to genetic and biometric data.

Article 9(2) sets out the circumstances in which the processing of special category of personal data which is otherwise prohibited, may take place. These include, among others:

  • Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law
  • Necessary for the carrying out of obligations under employment, social security or social protection law, or a collective agreement
  • Necessary to protect the vital interests of a data subject who is physically or legally incapable of giving consent.

Please visit:

In Greece, special category of personal data cannot be processed for health or life insurance purposes. This prohibition also extends to broader family members (i.e., it is forbidden to process sensitive data of the parent to determine the health or life insurance particulars of the child).



The GDPR definition of ‘consent’, written in Art. 4 (11), is: “‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.


Children’s age

Minimum age to provide consent is lowered to 15 years (Art 6 Greek Law).