Greece Law 4624/2019 - Hellenic Data Protection Authority (HDPA) Implementation Act Art.45: Articles 45, 45A, 47 and 48: principles, lawful basis and further purposes for competent authorities

Personal data are processed lawfully and fairly, for specified, explicit and legitimate purposes, adequate, relevant and not excessive, accurate and kept up to date, kept identifiable no longer than necessary and secured, and the controller can demonstrate compliance. Under Article 45A (added by Law 5002/2022) processing is lawful only if based on national or Union law and necessary for a task for the Article 43 purposes, and that law states at least the purposes, the data, integrity and confidentiality procedures and the competent authorities. Processing for another purpose is allowed only if it is an Article 43 purpose the controller is authorised by law to pursue and is necessary and proportionate (Article 47 as amended); archiving, research and statistics within Article 43 need public interest and safeguards such as early anonymisation and separation (Article 48).