Greece Law 4624/2019 - Hellenic Data Protection Authority (HDPA) Implementation Act Art.49: Articles 49 to 51: consent where the law provides it, instructions and staff confidentiality

Where the law bases processing on the data subject's consent, or on measures the data subject may request, the controller can prove it; before consenting the data subject is told the purpose, the data (notably special categories), the controller, the expected duration, usual recipients, the legal consequences of giving or refusing consent and the right to withdraw it; consent is clear, specific, written and free, separable from other matters and explicit for special categories (Article 49 as replaced by Law 5002/2022). Everyone acting under the controller or processor processes only on the controller's instructions unless the law provides otherwise, and everyone employed in processing acts on authorisation and is bound to confidentiality that survives employment (Articles 50 and 51).