Greece

(a) What is the NIS2 implementation status?

Law 5160/2024 was officially published on 27 November 2024, transposing NIS2 (the “Law”).

(b) What is the envisaged NIS2 implementation timeline?

As stated above, the NIS2 Directive was implemented into Greek law in November 2024.

(c) What does the NIS2 mean for other national cybersecurity legislation?

The Law has repealed and effectively replaced Law 4577/2018, which had transposed NIS1, as well as articles 148 (“Security of networks and services”) and 149 (“Implementation and enforcement”) of Law 4727/2020, which has transposed Directive (EU) 2018/1972 on establishing the European Electronic Communications Code.

(d) Who will be the supervisory authority and how are they preparing the market?

The supervisory authority in Greece will be the National Cybersecurity Authority (NSA). To assist stakeholders in understanding the scope of NIS2, as outlined by Implementing Law 5160/24, particularly regarding the classification of entities into essential and important entities and their respective obligations, the National Cybersecurity Authority offers two hotlines, which can be found on their website.

(e) What should you be doing/on the lookout for?

Clients should adopt appropriate and proportionate technical, operational and organisational measures including, inter alia, the adoption of a unified cybersecurity policy, the maintenance of a comprehensive inventory of tangible and intangible information and communication assets, and the appointment of an Information Technology Systems and Communications Security Officer.