DPA case 18/2025 – Violation Found (Greece, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Hellenic Data Protection Authority found that a Chinese company providing AI services to EU users failed to comply with GDPR. The company denied offering services in the EU but was reminded of its obligations under the law. This ruling highlights that companies outside the EU must still follow GDPR if they target EU users.
What happened
A Chinese company providing AI services was found to be subject to GDPR despite claiming it did not operate in the EU.
Who was affected
Users in the EU, particularly in Greece, who interacted with the company's AI services.
What the authority found
The authority ruled that the company must comply with GDPR and appoint a representative in the EU.
Why this matters
This case emphasizes that non-EU companies must adhere to GDPR if they target EU users. Businesses should ensure they understand their obligations when offering services across borders.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Hangzhou DeepSeek Artificial Intelligence Co. (DeepSeek) is a company established in China that provides an LLM platform called ‘DeepSeek AI’, to data subjects located in Europe. The Hellenic DPA initiated ex officio investigations against DeepSeek for the services provided in the EU and particularly in Greece. The DPA addressed a letter to DeepSeek reminding them that they fall within the scope of the GDPR according to Article 3(3) GDPR and have an obligation to a appoint a representative in the EU in writing pursuant to Article 27 GDPR. The DPA also addressed them a number of questions in order to determine their compliance with the GDPR, regarding the lawfulness of processing, the processing activities and the legal basis for each processing activity of personal data of data subjects located in Greece, their obligation to ensure that data subjects can exercise their rights and the location of the data centres used for hosting and providing the DeepSeek software. DeepSeek denied offering services in the EU and therefore falling within the scope of the GDPR, but stated that they are willing to accept the DPA's advice and guidance on this obligation. DeepSeek answered the questions vaguely without mentioning all relevant provisions of the GDPR and stated that they store data in China, without mentioning the establishment of additional legal safeguards. Furthermore, DeepSeek’s privacy policy does not make any reference to the GDPR and uses unclear wording. After examining all relevant information, the DPA issued a decision. First, the DPA held that the services offered by DeepSeek are undoubtedly addressed and targeted to EU data subjects and therefore DeepSeek falls within the scope Article 3(3) GDPR. DeepSeek, acting as a controller, makes clear its intention to offer services to data subjects located in the EU and in particular to Greece, as it is accessible both via the internet and through mobile applications to data subjects located in Greece and the ap
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 18/2025 in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 18/2025 - Greece (2025). Retrieved from cookiefines.eu
Last updated: