Greece - Data Governance Implementation (5188/2025)

Overview

Law 5188/2025 (FEK A' 49/28-03-2025) adopts national measures to implement Regulation (EU) 2022/868 (the Data Governance Act) and to define the National Strategy and institutional framework for public sector data in Greece. The law focuses on enabling the re-use of protected public sector information, establishing a supervisory framework for data intermediation service providers and a register for data altruism organisations, and creating governance structures within the Ministry of Digital Governance to implement a five-year National Strategy for public sector information. The published Government Gazette entry and official administrative procedure records define the law's articles and administrative attachments; the full published act is accessible through the national FEK record (see Government Gazette (FEK) A' 49/28-03-2025) and administrative guidance is published on the Ministry of Digital Governance registries and procedure portals (e.g., Ministry procedural registry).

Definitions

The law imports several core definitions from the Data Governance Act and clarifies them in Greek law: 'data' (digital representation of acts, facts or information), 'protected public sector data' (data held by public sector bodies that are legally protected by personal data rules, IP or confidentiality), 'data intermediation services' (services that facilitate the exchange of data between data subjects/holders and third parties), 'data altruism organisation' (legal persons which make data available for altruistic objectives and seek voluntary registration), 'single information point' (the platform and administrative function to coordinate access requests), and 'Data Use Officer (DUO)' (an appointed official in each central government body responsible for managing requests and compliance under the law). These definitions are used throughout the instrument to determine application, duties and rights.

Governance and Institutional Framework

Article-level provisions designate the Ministry of Digital Governance as the single information point and as the competent supervisory authority for the notification/recognition and oversight of data intermediation services and the registration of data altruism organisations. The law establishes a Coordinating Committee for public sector information within the Ministry, charged with drafting the National Strategy and coordinating cross-sectoral working groups. Each central government body is required to appoint a Data Use Officer (DUO) who will manage requests for reuse of protected data, liaise with the Ministry, and implement the National Strategy at the entity level. The DUO must be a person distinct from the Data Protection Officer and the Information and Communication Systems Security Officer to maintain separation of operational responsibilities. Administrative guidance and procedural forms for registrations, notices and submissions are issued and maintained on governmental portals (see the Ministry registry and procedural pages like procedural entry).

Key Focus Areas

Law 5188/2025 concentrates on several interlocking policy goals: (1) enabling lawful re-use of protected public sector data while ensuring compliance with data protection and confidentiality obligations; (2) fostering trustworthy data exchange markets through registration and oversight of data intermediation service providers; (3) supporting civic and research-driven data sharing via a voluntary register of recognised data altruism organisations; (4) promoting interoperability, machine-readability and anonymisation 'by design' within public sector data publishing practices; and (5) creating a national strategic framework that sets principles, targets and responsibilities for public sector data management for a five-year period. The law explicitly reaffirms the primacy of Union data protection rules (GDPR / Regulation (EU) 2016/679) and coordinates with sectoral EU instruments (including the Data Governance Act itself and the Interoperable Europe Regulation). Practically, the law requires public bodies to catalog protected datasets, to provide access decisions through the single information point, and to maintain procedures for timely processing, reasoned refusals and judicial review opportunities. It also prescribes conditions for data intermediation service providers to notify and operate and for data altruism organisations to register, publish charters and ensure governance safeguards.

Implementation Framework

The Ministry of Digital Governance is responsible for drafting the National Strategy (five-year duration) which becomes binding on public sector bodies. The Coordinating Committee may establish working groups, including external experts, to develop sectoral implementation roadmaps. Public sector bodies must appoint DUOs and update internal procedures, metadata inventories and anonymisation processes. The law requires development and maintenance of the single information point (a digital portal) that centralises applications and decisions; administrative workflows and time limits are stipulated in the implementing provisions. The notification and registry procedures for data intermediation services and data altruism organisations follow specified templates; decisions on recognition or refusal include due process safeguards and are subject to appeal. The implementation architecture anticipates cooperation with data protection authorities and other sectoral regulators to ensure complementary oversight and to avoid regulatory gaps or overlaps.

Monitoring and Evaluation

The law mandates periodic reporting and monitoring mechanisms: the Ministry must publish annual status reports on implementation, including statistics on requests processed through the single information point, entries and removals from the data altruism register, notifications of data intermediation providers and enforcement actions taken. The Coordinating Committee compiles recommendations, sets KPIs for dataset publication and anonymisation rates, and proposes regulatory adjustments. Independent oversight is supported through judicial review of administrative decisions. The law also requests alignment with EU-level monitoring instruments (such as reporting to the European Data Innovation Board) to ensure interoperability and comparability across Member States.

Penalties, Liability, and Appeals

Enforcement provisions grant the Ministry administrative powers to impose corrective measures and sanctions following a prior hearing. The primary monetary penalty range set out in the national implementing text is between €10,000 and €100,000 for relevant breaches, subject to proportionality and due process. The law allows for additional measures including warnings, temporary suspension or removal from national registers, and injunctive remedies to halt non-compliant activity. Decisions imposing sanctions are subject to appeals on the merits before the competent Administrative Court of Appeal. The law also clarifies that liability under sectoral Union rules (including data protection law) is unaffected and that remedies under GDPR and national liability regimes remain available to injured parties.

Relationship to Other Instruments

Law 5188/2025 explicitly implements and meshes with EU-level instruments. It transposes obligations arising from Regulation (EU) 2022/868 (Data Governance Act) and references Regulation (EU) 2016/679 (GDPR) as the prevailing rule for personal data protection. The law coordinates with the Interoperable Europe Regulation (Regulation (EU) 2024/903) concerning technical and organisational interoperability for public services. In the national context, the law interacts with administrative transparency legislation, sector-specific data regimes, and future laws on sectoral data spaces; it is designed to be complementary and without prejudice to pre-existing national confidentiality or public security exceptions.

International Alignment

The law aligns Greece with EU-level goals to create a single market for data by implementing the Data Governance Act and contributing to EU-wide governance through the European Data Innovation Board. The national framework supports cross-border data intermediation and recognition of data altruism organisations under EU labels where applicable, while preserving GDPR constraints on transfers and processing. Greece's implementing measures are designed to be interoperable with Union registers and recognition frameworks and to facilitate participation of Greek organisations in EU data-sharing initiatives and research collaborations.

Implementation Timeline

Sources and References