Greece

ΥΠΗΡΕΣΙΑ 800 ΤΕΛΕΠΕΡΦΟΡΜΑΝΣ ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. ΠΑΡΟΧΗΣ ΥΠΗΡΕΣΙΩΝ (Teleperformance Greece)

100,000 €

GDPR enforcement action by Hellenic Data Protection Authority (HDPA) on 2026-10-05.

Rank · Sector

#26

of 224 in Employment

Rank · Greece

#19

of 107

Rank · All fines

#540

of 3,275

Case details

Authority: Hellenic Data Protection Authority (HDPA)
Date: 2026-10-05
Controller / Processor: ΥΠΗΡΕΣΙΑ 800 ΤΕΛΕΠΕΡΦΟΡΜΑΝΣ ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. ΠΑΡΟΧΗΣ ΥΠΗΡΕΣΙΩΝ (Teleperformance Greece)
Sector: Employment
Quoted Articles: Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 12 (3) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 (3) e) GDPR, Art. 32 GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Greek DPA has imposed a fine of EUR 100,000 on ΥΠΗΡΕΣΙΑ 800 ΤΕΛΕΠΕΡΦΟΡΜΑΝΣ ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. ΠΑΡΟΧΗΣ ΥΠΗΡΕΣΙΩΝ (Teleperformance Greece). The data subject, who was formerly employed by the controller, had complained about workplace harassment. In May 2025, they requested that emails and data relating to them not be deleted. However, the controller proceeded to deactivate and delete the data subject's accounts and data even before their employment contract ended. On 16 June 2025, the data subject filed an access request relating to their data. The controller extended the deadline for answering the request and, in September 2025, submitted only parts of the requested personal data. The controller's extension was found to be unjustified, as no information on retention could be found due to broken links in the privacy policy, and no measures had been taken to exempt certain data from the blanket deletion policy.

Open original source Links to the regulator's original publication or another source.