Greece NIS2 Transposition (Law 5160/2024)

Greek law transposing NIS2 with the National Cybersecurity Authority as competent authority.

JurisdictionGreece
CategoryCybersecurity
StatusActive
Effective date
Latest development

Recent developments

  • — Analysis of how Law 5160/2024, transposing NIS2, functions in practice, noting that registration with the National Cybersecurity Authority has closed, the authority is actively supervising entities, and Greek businesses face increased compliance and enforcement pressure under the new cybersecurity framework.[10] (source)
  • — Overview confirming that Greece has fully transposed NIS2 via Law 5160/2024 and that secondary legislation on registration and security measures has been adopted, meaning NIS2 is fully implemented and replacing the earlier NIS-based regime for covered sectors.[4] (source)
  • — Status update on Greece’s NIS2 transposition explaining that Law 5160/2024 (FEK A’ 195/27.11.2024) completed the principal transposition of Directive (EU) 2022/2555, positioning Greece among the member states with a fully operational NIS2 legal framework.[1] (source)
  • — Communication from the National Cybersecurity Authority highlighting Law 5160/2024 as the core instrument incorporating NIS2 into Greek law and serving as the basis for national cybersecurity supervision, registration, and enforcement activities.[14] (source)
  • — Greek-language article describing NIS2 as implemented by Law 5160/2024, emphasizing heavy fines and management liability for non-compliance and noting a ministerial decision (2267/2025) granting extended compliance deadlines for certain public-sector entities until 27-11-2026.[9] (source)
  • — Timeline-style update detailing Greece’s NIS2 status, confirming that Law 5160/2024 was published in Government Gazette A’ 195 on 27 November 2024 and summarizing key milestones for entities’ registration and implementation obligations under the new cybersecurity regime.[3] (source)
  • — Industry compliance guide explaining how Law 5160/2024 embeds NIS2 into Greek law, providing practical instructions for Greek organizations on risk management, incident reporting, governance, and sector-specific obligations, and highlighting significant operational impacts on cybersecurity programs.[8] (source)
  • — Legal briefing outlining recent cybersecurity regulatory developments following Law 5160/2024, including reference to Ministerial Decision 1689/2025 and the National Cybersecurity Authority’s publication of a dedicated gap-analysis tool (developed with ENISA) to help entities assess compliance gaps with NIS2 obligations.[11] (source)
  • — Practice guide chapter describing Law 5160/2024 as Greece’s core horizontal cybersecurity framework, detailing its application to essential and important entities in multiple critical sectors, and explaining requirements such as registration with the National Cybersecurity Authority and strengthened security and reporting obligations.[7] (source)
  • — Compliance-focused article on NIS2 implementation in Greece via Law 5160/2024, summarizing key regulatory milestones and extensions (including submission deadlines extended to 30 September 2025) and analyzing the law’s practical impact on governance, risk management, and potential fines for Greek organizations.[6] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates