- Enforcing jurisdiction
- Cyprus · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Hellenic Bank – €25,000 Fine (Cyprus, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Hellenic Bank was fined for a data breach involving old customer documents left in a safe after closing a branch. The bank learned about the breach only when a new tenant found the safe years later. This incident highlights the importance of properly managing customer data even after a location is closed.
What happened
Hellenic Bank failed to secure customer documents left in a safe after closing a branch.
Who was affected
Customers whose documents were left unsecured in the safe by Hellenic Bank.
What the authority found
The Cypriot data protection authority found that Hellenic Bank violated multiple GDPR rules regarding data security and breach reporting.
Why this matters
This ruling underscores the need for companies to maintain data security and proper management of customer information, even after a location is no longer in use.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Cypriot DPA imposed a fine of EUR 25,000 on Hellenic Bank. The bank had closed one of its branches in the city of Nicosia in 2015. When moving out of the space, a safe containing old documents of still existing customers, installed in one of the walls, had been forgotten. As the building was vacant in the following years, the controller only learned about this incident when the property was rented out again for the first time in 2019. The new tenant had found the safe and informed the controller. Bank staff had then retrieved the documents and reported the data breach to the Cypriot DPA. The DPA ultimately concluded that the controller had violated Art. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, and Art. 33 (1) GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for Hellenic Bank in CY
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
3 March 2021
Authority
Commissioner for Personal Data Protection
Fine Amount
€25,000
About this data
Cite as: Cookie Fines. Hellenic Bank - Cyprus (2021). Retrieved from cookiefines.eu
Last updated: