EU Data Compliance 2027 | The Complete Guide for Businesses in Greece

EU data compliance in 2027 will be judged on the records a company can produce, not the policies it publishes. Within one year, the Data Act, the Cyber Resilience Act, the AI Act (now enforced in Greece under Law 5321/2026) and the GDPR all ask the same question: what did you decide, who decided it, and why?

Most of those decisions were never taken by lawyers. Procurement chose the cloud provider, engineering shipped the connected product, and a dataset was kept because deleting it felt riskier. When regulators ask for an explanation, legal is expected to give it. That makes 2027 an operating issue as much as a legal one.

Key dates at a glance

• 12 January 2027: no more switching or data egress fees for cloud and data processing services (Data Act, Article 29).
• 12 September 2027: Data Act unfair term rules reach certain older long term contracts (Article 50).
• 2 December 2027: AI Act high risk obligations for Annex III systems apply.
• 11 December 2027: the Cyber Resilience Act applies in full.
• 2 August 2028: AI Act high risk obligations for Annex I product systems apply.

1. The EU Data Act tests your cloud exit clause

The Data Act (Regulation (EU) 2023/2854) has applied since September 2025. Its switching rules aim to let businesses leave a cloud provider without technical, commercial or contractual lock in. Most companies can find their exit clause. Few can say what format their data would leave in, which dependencies sit underneath it, or what the move would cost.

From 12 January 2027, providers of data processing services may no longer charge for switching, including data egress fees. From 12 September 2027, the unfair term rules can also reach contracts signed before September 2025 that are of indefinite duration or run for ten years or more. This calls for a targeted review, not reopening every agreement.

With Greece now a major data center hub, many Greek companies are moving core workloads to the cloud on standard terms. The Data Act gives them new leverage, if they use it.

What to do now:

• Separate genuine data processing services from ordinary SaaS; only the first are caught by the switching duties.
• Request a test export from your main provider and record the format, dependencies and fee.
• Flag long term pre 2025 contracts for review before September 2027.

2. The Cyber Resilience Act makes product security a legal record

If you manufacture, import or distribute hardware or software with digital elements in the EU, the Cyber Resilience Act (Regulation (EU) 2024/2847) turns security into a documentation duty. Since 11 September 2026, manufacturers must give an early warning within 24 hours of an actively exploited vulnerability or severe incident, and a fuller notification within 72 hours. From 11 December 2027, the regulation applies in full, including conformity assessment and CE marking.

Classification, support periods, vulnerability decisions and customer notifications must all be traceable and must travel with the product through the supply chain. Many of the same companies are also subject to NIS2, transposed in Greece by Law 5160/2024, with its own reporting clocks.

What to do now:

• Name who classifies each product, who declares an incident reportable and who signs the notification.
• Merge CRA, NIS2 and GDPR notification duties into one incident playbook.
• Write vulnerability disclosure, security update and support period obligations into supplier and distribution contracts.
• Brief the board: fines reach EUR 15 million or 2.5% of worldwide turnover.

3. The AI Act runs on several clocks, and Greece now enforces it

The AI Act (Regulation (EU) 2024/1689) switches on in stages. Prohibited practices and AI literacy duties have applied since February 2025, and general purpose AI rules since August 2025. The AI Omnibus (Regulation (EU) 2026/1744), in force since 27 July 2026, moved the high risk tier: 2 December 2027 for Annex III systems such as recruitment, credit scoring and education, and 2 August 2028 for AI embedded in regulated products. The delay changes when duties apply, not whether a system is high risk.

In Greece, Law 5321/2026 (ΦΕΚ Α΄ 114/20.07.2026) makes the Hellenic Data Protection Authority the main market surveillance authority for prohibited practices, Annex III systems and transparency duties. EETT is the notifying authority and hosts a national AI sandbox with the HDPA. Law 4961/2022 also remains in force where the AI Act is silent, for example on informing employees about AI used in workplace decisions.

Note that the separate Digital Omnibus proposal to amend the GDPR is still under negotiation. Do not plan around it.

What to do now:

• Keep a dated AI inventory with an owner and risk class for each system.
• Start Annex III documentation now; eighteen months is less than it sounds.
• Decide which logs and technical files you will keep before anyone asks.

4. GDPR purpose limitation meets the AI appetite for old data

The GDPR has not changed, but the pressure on it has. Companies want to feed years of customer and employee data into AI and analytics. Article 5 still requires purpose limitation and data minimisation, and Article 35 still requires a DPIA for high risk processing. A privacy notice updated in 2027 cannot change what people were told in 2021.

In Greece the stakes are higher, because the HDPA now supervises both personal data and most AI risk, and can examine one system under both regimes at once.

What to do now:

• Retrieve the notice that applied at collection before approving any new AI use.
• Record the original purpose, the compatibility assessment and why the data volume is proportionate.
• Complete a DPIA where required and set a clear deletion trigger.

5. Legal teams must govern the AI they use

Legal departments increasingly use AI for contract review, research and drafting. Most of these tools are not high risk under the AI Act, but the Act’s evidence logic still applies: if a client or regulator asks how a conclusion was reached, legal must be able to answer. For Greek lawyers, professional secrecy under the Code of Lawyers (Law 4194/2013) adds a further layer.

Ask every legal AI vendor four questions:

1. Is our data used to train the model?
2. Where is the data processed?
3. What is logged for each event?
4. How long are the logs kept?

No AI generated clause or opinion should enter the file until a lawyer has reviewed it. We apply the same standard to our own legaltech platform, ThemisBlock, built so that every review step is traceable.

One evidence trail, three steps

All five pressure points end with the same request: show the contract, the supplier, the product decision, the data use and the owner. The companies that handle 2027 well will build that evidence trail once and use it for every regime.

• Map: inventory your cloud contracts, connected products, AI systems and datasets for reuse, each with an owner and review date.
• Assess: classify each item under the Data Act, CRA, AI Act and GDPR.
• Fix: amend key contracts, adopt one incident playbook and an AI policy, train staff and brief the board.

How Tsamichas Law Firm can help

Our Technology, Innovation & Digital practice advises companies in Greece and across Europe on Data Act contract reviews, CRA and NIS2 readiness, AI Act and Law 5321/2026 compliance, DPIAs and DPO support, and AI governance for legal teams.

Frequently asked questions

When do cloud switching fees end under the EU Data Act? On 12 January 2027, when providers of data processing services may no longer charge for switching or data egress.

Who enforces the AI Act in Greece? Under Law 5321/2026, the Hellenic Data Protection Authority is the main market surveillance authority, and EETT is the notifying authority.

Can we use existing customer data to train AI? Only if the new use is compatible with the original purpose or has its own legal basis, and the data is proportionate. A DPIA is often required.

This article is for general information only and does not constitute legal advice. It reflects the law as of 16 October 2026.