## Infrastructure Operators must locate a server in the territory of Greece. Operators must grant the HGC access to stored data on the server for a period of at least ten years. Alternative safe storage devices must also be located within a member state of the EU or the EEA which acts as a form of disaster recovery system where synchronisation will need to occur at least every 30 mins. The regulator has also signaled closer cooperation with telecommunications and domain-registration authorities, including the Hellenic Telecommunications and Post Commission (EETT), with the stated objective of accelerating the identification of gambling-related domains at or shortly after registration, thereby reducing the window during which illegal sites can access Greek consumers. The server requirement derives from Article 198(5) of Law 4635/2019. The electronic files and registers listed in Article 34.1 of Ministerial Decision 79835/2020 must be kept for at least ten years from the day after they are created, in a form that shows any corrections and gives the HGC immediate and easy access (Articles 34.2 and 34.4, Ministerial Decision 79835/2020). Personal data breaches must be notified to the Hellenic Data Protection Authority without undue delay and, where feasible, within 72 hours. Affected players must be notified without undue delay where the breach is likely to result in a high risk to them (Articles 33 and 34, Regulation (EU) 2016/679; Law 4624/2019). ## Integrations There is no requirement for integration with local regulatory or monitoring systems ## Software certification Holder of Type 1 and Type 2 licences must comply with the technical standards laid out in Law No. 4002/2011. Gaming machine technical standards can be also be found in Law No. 4002/2011. A list of technicians and testing laboratories approved by the HGC is linked here. The conditions that independent testing laboratories and certification bodies must meet for their reports and certificates to be accepted are set by HGC Decision 106/6/23.05.2014 (Government Gazette B’ 1432/04.06.2014). The HGC accepts laboratories that meet the applicable European or international standards and are accredited by the Hellenic Accreditation System (ESYD) or by a body with which ESYD has signed a mutual recognition agreement. Technical specifications for online gaming are set out in Ministerial Decision 79841/2020 (Government Gazette B’ 3266/2020). Quality management standards are based on ISO 9001 (Article 5.1(b)(kk), Ministerial Decision 79835/2020). Information security standards are based on ISO/IEC 27001, which applies to all systems, subsystems and software used for online gaming and to the intermediate control system under Articles 32 and 33 of Ministerial Decision 79835/2020. Licensed operators in Greece are subject to reporting and operational obligations administered by the EEEP under the Law 4002/2011 framework. The draft EEEP reform bill broadens EEEP's responsible-gambling coordination mandate, enabling it to commission research, develop national strategies to reduce unlicensed participation, and coordinate programmes across the sector. The EEEP-OHQA memorandum reinforces the responsible-gambling operational framework, and the planned Gambling Observatory will introduce Big Data and AI-based supervisory monitoring that operators will need to interface with. The government is signalling integration of betting age verification with secure government ID infrastructure, which will impose new technical obligations on operators' onboarding and age-verification systems once enacted. The active Hellenic AML Authority investigation into affiliate-retailer cash-deposit schemes highlights that existing KYC and deposit-channel monitoring obligations are under active scrutiny; operators must maintain robust controls over third-party deposit channels and affiliate-retailer arrangements. New operational obligations under the draft bill are anticipated but not yet enacted, and the precise scope of reporting, technical certification and RG operational requirements post-enactment will depend on the final gazetted text.
Greece · Question 09 of 11
Distribution and platforms: Can we ship through apps and platforms?
Mixed · Uncertain · Expert approved · 4 post-review updates · Not reviewed · In expert review scope · Back to full Greece report →
Key section parameters
| Jurisdiction | Greece (GR) |
|---|---|
| Regulator | HGC |
| Favourability | Mixed |
| Confidence | Uncertain |
| Review status | Expert approved · 4 post-review updates · Not reviewed · In expert review scope |
| Last collected | 18 Oct 2026 |
Summary answer
## Infrastructure Operators must locate a server in the territory of Greece. Operators must grant the HGC access to stored data on the server for a period of at least ten years. Alternative safe storage devices must also be located within a member state of the EU or the EEA which acts as a form of …
Social-media promotion of unlicensed gambling by influencers and affiliates has become a live enforcement target in Greece. The Hellenic Gaming Commission filed legal complaints against 18 social-media influencers, with a combined 3.6 million followers, for promoting unlicensed gambling, and the Finance Minister has stated that popularity offers no immunity from the sanctions regime expanded under Law 5313/2026. This signals that affiliate-marketing and sponsorship-intermediary channels carrying unlicensed-operator promotion now face direct accessory-liability exposure under the Law 5313/2026 enforcement framework the HGC is actively implementing, rather than facing exposure confined to the unlicensed operators themselves.
The draft omnibus bill proposes to grant EEEP the power to order internet service providers, platforms and search engines to remove or disable illegal gambling content, sites and accounts operated by unlicensed gambling businesses. This represents a new platform-level enforcement mechanism targeting distribution channels used by unlicensed operators, consistent with the civil-law pattern of statutory blocking regimes seen elsewhere in the family. The provision has cleared public consultation as of 15 June 2026 but remains unenacted, so no current legal obligation binds ISPs, platforms or search engines in Greece under this mechanism at this time.
The most significant distribution-and-platform development this cycle is the new standalone advertising-liability offence created by Law 5313/2026, Article 66, amending Article 51 of Law 4002/2011. This durable statutory change establishes liability of EUR 5,000 to 50,000 for advertising or promoting unlicensed gambling, extending the enforcement perimeter beyond operators to affiliates, advertising networks, and media outlets that carry promotion for unlicensed sites. This is a material expansion of the distribution-liability perimeter compared with the prior operator-only enforcement focus, and it sits alongside the Hellenic Gaming Commission's continued blocking of unlicensed domains (approximately 11,000 blocked as of December 2025) as part of the broader platform-enforcement toolkit. No other distribution or platform-rule development — app-store, ISP-blocking-mechanism, or payment-provider-restriction change — was identified this cycle.
This cycle's sole distribution-and-platform development concerns domain-level enforcement rather than app-store or advertising-platform rules. The Hellenic Gaming Commission is reported to be pursuing closer integration with EETT, the national telecoms regulator, with the aim of achieving near-real-time flagging of newly registered illegal-gambling domains, as part of the Commission's broader 2026-2030 strategic plan. This would mark a shift from the current post-complaint blocking model, under which approximately 11,000 cumulative domain blocks had been recorded by December 2025, toward a more proactive detection posture at the point of domain registration. The initiative is evidenced by a single tier-three source, with no regulator-published technical specification or implementation timeline located this cycle, and should accordingly be treated as an uncertain, forward-looking development rather than an implemented instrument.