GDPR, DPO, compliance and responsible management of personal data
MStR Law Firm
Personal data is no longer a “technical” or secondary compliance issue. It is part of the very relationship of trust that a business develops with its customers, employees, partners and the public. Every contact form, every newsletter, every electronic transaction, every personnel file, every video surveillance system, every platform, application or database creates an information trail. The critical question is not only whether the business “has GDPR”, but whether it knows what data it collects, why it collects it, who has access to it, how long it retains it, how it protects it and how it can prove this when required.
The current data protection framework, centred on the General Data Protection Regulation (GDPR), requires businesses and organisations to organise their compliance in a real, documented and functional manner. In Greece, the Hellenic Data Protection Authority supervises the application of the GDPR, Law 4624/2019 and Law 3471/2006 on the protection of natural persons with regard to the processing of personal data.
Our team provides comprehensive legal support in matters of personal data protection, regulatory compliance, privacy policies, data processing agreements, management of data subject requests, legality checks of processing activities, data transfers, data breach incidents and the organisation of internal procedures. We map data flows, identify risk points, draft policies that can actually be implemented and create an accountability framework that does not remain theoretical.
We place particular emphasis on the role of the Data Protection Officer — DPO, where appointment is required by law or where the nature and scale of the activity make more systematic supervision necessary. The DPO is not a decorative title or a mere formal reference in a privacy policy. The DPO is a point of reference for the business, the data subjects and the supervisory authority, with an advisory, monitoring and organisational role. The GDPR provides for the appointment of a DPO, among other cases, where the core activities involve large-scale systematic monitoring of individuals or large-scale processing of special categories of data.
In this context, we support businesses and organisations that require an external DPO or legal guidance for their internal DPO. We advise on the obligations of the controller or processor, monitor compliance, support the conduct of impact assessments, assist in communication with the Authority and contribute to the development of practical procedures for day-to-day data management.
At the same time, we support businesses in issues that frequently arise in practice: employee and customer notices, privacy and cookie policies, agreements with service providers, use of CRM and marketing tools, sending of newsletters, online sales, management of CVs, security cameras, employee access to corporate systems, data transfers to third countries, cloud services and cooperation with external technical or commercial providers.
In the event of a data breach, speed and accuracy are decisive. We support our clients in assessing the incident, preparing internal documentation, evaluating the risk, making any required notification to the supervisory authority or affected persons and adopting corrective measures. The aim is not merely to manage a crisis, but to restore trust and prevent the same risk from recurring.
Data protection does not mean that a business must stop using technology, marketing, digital tools or information analysis. It means using them under conditions of legality, transparency and control. A properly organised data policy does not restrict growth; it supports it, because it enables the business to operate with greater security, clearer procedures and a stronger relationship of trust with those who interact with it.
Our team stands alongside businesses, professionals, organisations, platforms, employers and digital service providers, offering solutions that combine legal accuracy, practical implementation and an understanding of today’s digital reality.
For us, GDPR compliance is not an exercise in bureaucracy. It is an architecture of trust: the way in which a business demonstrates that it respects the information entrusted to it and that it can manage it responsibly, transparently and securely.