Can we record a simulation call in Greece?

Practically no. Since December 2022 recording your own telephone conversation without the other party's express consent is a felony carrying up to ten years, and the Constitution separately bars using evidence obtained in breach. Design Greek exercises to produce outcomes rather than audio.

Do Greek works councils have a say over monitoring?

Where one exists, a decisive one. The manner of monitoring the presence and conduct of personnel is decided jointly with the employer, recorded in a written agreement with normative force, and deadlock goes to an administrative committee rather than resolving in the employer's favour.

Who enforces the AI disclosure duty in Greece?

The data protection authority, designated in July 2026 for both the prohibited practices and the transparency article. The same law makes it a criminal offence, punishable by imprisonment and a fine, to remove the required markings or to remove or obstruct the deepfake disclosure.

Compliance

Voice phishing simulations in Greece

Phone numbers in GreeceProvisioned by Callstrike after approval

Greece permits an authorised voice phishing simulation against your own workforce, and Callstrike clears the country and assigns the number. Two Greek facts shape the programme before anything else does: recording the call is a felony rather than a compliance question, and where your Greek entity has a works council, the manner of monitoring staff is decided jointly with it rather than by you.

Phone numbers

Supplied by Callstrike

Local numbers in Greece, after a one-time approval.

Running a simulation

Permitted, and decided jointly where a council exists

Without a council it is your decision. With one it is an agreement, and deadlock goes elsewhere.

Consent

The exception, by statute

The employment article makes it exceptional and weighs the dependence it is given under.

Getting a phone number in Greece

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Callstrike clears Greece against your workspace and provisions the number, so your side of it is one filing. Two things about that filing are specifically Greek and both are about freshness and place. The registration document has to be a government-issued business registration dated within the last twelve months, either a digitally issued and electronically signed registry certificate or one stamped by a competent authority such as a chamber of commerce or the tax administration. A correct extract pulled two years ago will not do, and that is the commonest reason a Greek filing goes back.

The address has to be a Greek operational address inside the locality or region the number's own prefix covers, and a post office box is not accepted. Then plan for where the traffic originates, because Greece answers that with a rejection rather than a warning. Since late 2025 calls entering Greek networks over an international interconnection while presenting a Greek country code are rejected outright, with narrow technical carve-outs for roaming and forwarding, and the commencement window closed in May 2026. An offshore Greek campaign does not produce a suspicious call, it produces no call at all. We originate Greek traffic inside Greece for that reason.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Greece is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Proof of business registrationProvide a government-issued business registration document dated within the last 12 months. Either a Digitally issued, electronically signed registry certificate/extract (e.g., from https://services.businessportal.gr), or Signed/stamped certificate from a competent authority (chamber of commerce, municipality, or AADE in Greece).	Extract from the commercial register
Proof of local addressMust be a Greek operational address within the locality or region covered by the phone number's prefix; a PO Box is not acceptable.	Extract from the commercial register showing local address, Utility bill, Tax notice, Rent receipt, Title deed

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Greece?

The position in short, before your counsel reads the detail below.

Yes, and the telephone rule is the straightforward part. The Greek provision on automated calling systems used without human intervention is permitted only with prior express agreement where the purpose is direct commercial promotion of products or services or advertising of any kind, and the neighbouring paragraph governing live calls through the opt-out register attaches itself to the same purposes. There is no employer or employee exception anywhere in the article, and none is needed: what puts an internal test outside it is that it promotes nothing.

The Greek decision is whether your entity has a works council, because that changes the character of the project rather than its timetable. A 1988 statute makes the manner of monitoring the presence and conduct of personnel a matter the council decides jointly with the employer, recorded in a written agreement carrying normative force, with disagreement resolved by a competent administrative labour committee rather than in your favour. That is not consultation: you agree or you do not proceed. Two honest limits. A council is not automatic, arising at fifty employees or twenty where no union operates and only where staff have actually exercised the right, so many Greek employers have none and none of this bites. And the prefectural tier the statute names as the deadlock forum was abolished in a later reform, with no successor we could establish. Whether a simulation counts as the manner of monitoring conduct is close enough that a Greek employer with a council should raise it rather than assume.

Do not record. Since December 2022 recording your own telephone conversation without the express agreement of the other party carries confinement of up to ten years, a felony rather than the misdemeanour it was before, and a further amendment removed the qualifier that had confined the offence to improper conduct, so using the material carries the same ceiling. The word that decides it is express, which is structurally incompatible with a call whose whole design is that the other party does not know what it is. And the Constitution then takes away the reason you wanted the recording, because evidence obtained in breach of the secrecy article may not be used at all. The exposure and the loss of the artefact arrive together.

One more Greek fact belongs in a product conversation rather than a legal one. Greece designated its data protection authority for the European transparency duty in July 2026, and the same law made it a criminal offence, punishable by imprisonment and a fine, to remove the machine-readable markings on synthetic content or to remove or obstruct the deployer's disclosure that audio is artificially generated. No other country in this portal attaches a custodial sentence to that. Read it before anyone proposes suppressing a disclosure for the sake of realism.

What your company needs to do

6 items, in the order you will need them.

Find out whether your Greek entity has a works council, firstGreece-specificEverything else on this page follows from the answer. Where one exists, the manner of monitoring staff conduct is a joint decision recorded in a written agreement with normative force, and a refusal goes to an administrative committee rather than resolving your way. Where none exists, the same programme is yours to decide and document.
Design the exercise to produce outcomes rather than audioGreece-specificThis is not a proportionality judgement in Greece. Recording your own call without the other party's express agreement is a felony, and the Constitution separately bars using anything obtained in breach. Capture whether the call was answered, whether anything was disclosed and where the person disengaged, and keep no recording.
Write the record against the statute's own standardGreece-specificGreece used the European employment derogation to narrow rather than widen: employee data may be processed where that is absolutely necessary for the performance of the contract, and absolutely is the word the statute chose. No Greek source positively endorses a balancing test for employee monitoring, so argue necessity rather than assuming a domestic endorsement exists.
Give the notice before monitoring begins, not alongside itThe regulator's directive confines monitoring to data directly connected with the employment relationship and requires that it not offend dignity. A dated programme-level notice, given in advance, saying that exercises of this kind take place, what they measure, who sees the result and how long it is kept, is what that rests on.
Never let a disclosure be stripped for realismGreece-specificRemoving the required markings on synthetic content, or removing or obstructing the disclosure that audio is artificially generated, is a criminal offence in Greece carrying imprisonment and a fine. That is a design constraint on the product with a custodial sentence attached, and it is enforced by the same authority that supervises the transparency duty.
Originate inside Greece, on a number whose right of use is verifiedGreece-specificThe presented number must be assigned to the subscriber, and the provider checks the lawful right of use before activating identification, blocking calls that present fictitious or unassigned numbers. Calls arriving from abroad with a Greek country code are rejected. Assignment is a right of use rather than ownership, so there is nothing to buy and nothing to lend.

The controls that do the work

How Callstrike is configured, and which provision in Greece each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Greece sets the highest standard on the ground itself, allowing employee data to be processed where that is absolutely necessary for the employment contract, and the regulator confines monitoring to what is directly connected with the relationship. The call ends the instant an employee begins to give up a credential, so the credential is never spoken into the system and never held, and what you are arguing is necessary is a measurement rather than a collection. It is also the shortest answer to a works council asking what you will actually be holding afterwards.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The regulator's directive requires that monitoring not offend human dignity, and where a works council exists that is the standard the joint agreement is written against. A second voice that breaks character the moment the call ends, with vishing training in writing the same day and results never individualised into anyone's record, is a concrete term you can put into that agreement rather than an intention you describe.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

The Greek employment article makes an employee's agreement the exception rather than the route, and directs that its freedom be assessed against the dependence in the contract, so this is not what unlocks the programme and it is no substitute for the council's agreement. What it produces is the advance notice the directive requires, dated before the campaign, or a hashed copy of the policy or agreement you already rely on with a signed attestation of the scope it covers.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the route that keeps teaching while the council conversation runs, and in Greece it also answers the delivery problem. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module, and a call opened in a browser never enters the Greek network over an international interconnection, so the rule that rejects inbound calls presenting a Greek country code has nothing to reject.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

Absolutely necessary, and consent only by way of exception

Greece used the employment derogation the GDPR offers, and used it to narrow rather than to widen. Employees' personal data may be processed for purposes of the employment contract where that is absolutely necessary for the decision to conclude the contract or, after conclusion, for its performance. Absolutely necessary is a stronger word than necessary, and it is the word the statute chose.

On consent the same article is explicit that it is the exception. Where processing has exceptionally as its legal basis the employee's consent, the assessment of whether the consent was the result of free choice must take into account chiefly the employee's dependence existing in the employment contract and the circumstances in which consent was given. The regulator's older directive makes the same point in different words: the element of dependence in the employment relationship weakens the weight of free consent, and monitoring must be confined to data directly connected with the employment relationship and must not offend human dignity.

That directive raises a status question worth answering properly rather than avoiding. Its enabling provision was repealed with the old data protection act, but the current act says in terms that the Authority's directives and regulatory acts remain in force provided they do not conflict with the GDPR and with that act. So it is neither current guidance nor a dead letter: it is alive to the extent it does not conflict. We can be confident the reading is right rather than an unmarked stale page, because the regulator's live index of directives annotates repeals where they have happened and carries no such marker against this one.

One gap we are going to name rather than paper over. We looked for a Greek instrument or decision affirming that the legitimate interests ground supports employee monitoring, and did not find one. The employment article does not disapply that ground, and nothing we read forecloses it, but no Greek source states it positively either. A Greek programme should expect to argue the basis from the Regulation and from the absolute necessity standard above, not from a domestic endorsement that exists.

A felony for recording your own call, and the evidence is barred

If you read one section of this page, read this one. Greece changed the law in December 2022 and the version most sources still reproduce is the one from before.

The criminal code provision on the secrecy of telephone communications now provides that the penalty of confinement of up to ten years applies also where the perpetrator records on a material medium the content of their own telephone communication with another, without the express consent of the latter. Read that twice. It is not about eavesdropping on other people's conversations. It is about recording your own call, and since December 2022 it is a felony rather than a misdemeanour. A parallel paragraph does the same for oral conversations, and a further paragraph deleted the qualifier that had confined the offence to improper conduct, so simply using such material now carries the same ceiling.

The word that decides everything is express. Not implied, not policy-notified, not inferable from a handbook: the express consent of the other party to the call. A simulation is designed so the other party does not know what the call is, which is structurally incompatible with obtaining their express consent at call time.

The Constitution then removes the reason you wanted the recording. The secrecy of letters and of free correspondence or communication by any other means is absolutely inviolable, and the use of evidence obtained in violation of that article is prohibited. So a recording made in breach is not merely a criminal exposure; it is unusable in the internal disciplinary or training process it was made for. The exposure and the loss of the artefact's purpose arrive together.

There is a second, independent all-party rule in the electronic communications privacy act, and it is narrower than people assume. Recording conversations is permitted where they take place in the course of lawful business practice for the purpose of providing evidence of a commercial transaction, on condition that both parties, after prior information about the purpose of the recording, give their consent. Note the gateway: evidence of a commercial transaction. A security-test recording is arguably outside that gateway before you even reach the consent problem.

For completeness, the independent authority that supervises communications privacy is provider-facing. Its audits, hearings and its most recent regulation address communications providers, and an employer running a simulation is not one, although it does examine complaints about breach of telephone confidentiality generally. Nothing there softens the criminal provision.

The practical conclusion is short. In Greece, do not record. Design the exercise so that its outputs are events and outcomes rather than audio, and if a Greek client insists on recording, that is a question for Greek criminal counsel and not for a vendor.

Advertising is the trigger, and the opt-out list is per operator

The Greek rule on automated calling is purpose-scoped, and the scoping words are worth having exactly. The use of automated calling systems without human intervention, for purposes of direct commercial promotion of products or services and for advertising purposes of any kind, is permitted only with the subscriber's prior express consent. The following paragraph, which governs live calls through an opt-out register, attaches itself to the same purposes.

That split dates from September 2011, when an amendment separated automated calling, which became opt-in, from live calling, which remained opt-out. The regulator quoted the article in exactly this form in a decision of June 2026, so the wording is current rather than reconstructed.

Two details matter operationally. The opt-out register is maintained per provider rather than as a single national do-not-call list, which surprises people who expect one lookup. And the regulator has drawn the boundary at purpose rather than at relationship: it has held that information and survey calls are lawful only while they stay within that purpose, and that a call of mixed character falls inside the article the moment commercial solicitation appears. There is no employer or employee exemption anywhere in the article. What takes an internal security test outside it is that it promotes nothing.

The European transparency duty is Article 50 of the EU AI Act, it applies directly, and Greece has done more with it than any other country in our coverage. Since 2 August 2026 a provider must design a system intended to interact directly with people so that they are informed they are dealing with an AI system, and a deployer of a system generating or manipulating audio constituting a deep fake must disclose that the content was artificially generated, in each case at the latest at the time of the first interaction or exposure. The only carve-out is use authorised by law for criminal law purposes, which an employer's own authorisation is not.

Greece designated its authority in a law of July 2026, and it chose the data protection authority for both the prohibited practices article and the transparency article. That same law then does something no other country in this portal has done: it makes it a criminal offence, punishable by imprisonment and a fine, to remove the machine-readable markings required of providers of synthetic content, or to remove or obstruct the deployer's deep fake disclosure. For a synthetic-voice product that is a design constraint with a custodial sentence attached, and it should be read before anyone builds a feature that suppresses a disclosure for realism.

The companion prohibition is the emotion one. Using AI systems to infer emotions of a natural person in the workplace has been prohibited since 2 February 2025, at up to thirty-five million euros or seven per cent of worldwide turnover, except where the use is intended for medical or safety reasons. We looked for a definition of safety reasons and there is none: the phrase occurs exactly once in the whole consolidated instrument, inside the exception it creates. The gate on the prohibition is a definition confined to inference from biometric data. Counting outcomes is safe; scoring how a named employee sounded is an argument about an undefined exception to an unresolved gate, in front of the same authority that supervises the transparency article.

The provider checks your right to the number before it works

Greece answers the caller identity question directly, which is unusual, and the answer is no.

The regulator's decision on calling line identification requires that the presented number be secondarily assigned to the subscriber, and that the subscriber consequently have a lawful right to use it. It then adds the sentence that makes the rule real: the provider checks the lawful right of use of the number before activating the identification service. A further paragraph requires providers to block calls presenting fictitious or unassigned numbers, and the same right-of-use test is applied to alphanumeric sender identifiers on text messages.

Underneath that, assignment is expressly a right of use and not ownership. The numbering decision says so in terms: assignments confer only the right to use the numbers and do not give rise to any acquisition of a right of ownership. So there is nothing to buy and nothing to lend.

Then the rule that decides whether your campaign functions at all. Since late 2025 the regulator has required that calls entering national networks from an international interconnection with a calling line identity beginning with the Greek country code be rejected. The carve-outs are narrow and technical, covering roaming numbers and call forwarding, and the forwarding case is delivered with the identity hidden. The commencement window ran to May 2026 and has elapsed.

Stated plainly: originating a call to Greece from outside Greece while presenting a Greek geographic number means the call is dropped, not flagged and not delivered with a warning. Greek traffic has to originate inside Greece on a number whose right of use the originating provider has verified.

One citation caution if you check this yourself. The general authorisations regulation was replaced in February 2026, so anything describing the Greek framework by reference to the 2021 instrument is now out of date.

What the country matrix holds for Greece

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

Where a council exists, monitoring is decided jointly

The received wisdom is that Greece has no German-style co-determination over monitoring. That is wrong, and the correction is the most consequential thing on this page after the recording rule.

A 1988 statute provides that the works council decides jointly with the employer on a listed set of matters, and the list includes the manner of monitoring the presence and the conduct of personnel, within the framework of the protection of employees' personality and in relation to audiovisual means. For those matters a written agreement is drawn up which has normative force, and in the event of disagreement the difference is resolved by the competent administrative labour committee by reasoned decision.

Three things follow. Joint decision is not consultation: the employer does not decide and explain, it agrees or it does not proceed. The output is an instrument with normative force rather than a minute. And deadlock does not resolve in the employer's favour by default; it goes to a third party.

Two honest limits on that. A works council is not automatic in Greece: the right arises in undertakings of at least fifty employees, or at least twenty where no trade union operates, and employees must actually have exercised it, so a great many Greek employers have no council and none of this bites. And the prefectural tier that the statute names as the deadlock forum was abolished in a later local government reform; we looked for the successor designation across four later statutes and did not find one. The right is live, and the machinery that makes it operative is unestablished.

Whether a vishing simulation is legally characterised as the manner of monitoring the conduct of personnel is a question no text answers, and we are not going to answer it for you. It is close enough that a Greek employer with a works council should raise it rather than assume.

Alongside that sits the ordinary European information and consultation machinery, and Greece implemented it more narrowly than it had to. The thresholds were taken conjunctively: the regime applies to undertakings employing at least fifty employees and establishments employing at least twenty, where the Directive offered the two as alternatives. Within it, activities and economic situation attract information only; the employment situation and structure, and decisions capable of bringing about substantial changes in work organisation or in employment contracts, attract information and consultation. The clause about seeking agreement attaches only to that last category and is expressly framed around decisions falling within the employer's competence, and the only owed output is a reasoned reply. There is no veto in that instrument. The veto, where it exists, is the 1988 one.

Annual training is mandatory here, and it is about messages

Greece transposed the European network and information security directive in November 2024, in force from publication, repealing the operative articles of the 2018 act. It was never referred to the Court of Justice; the non-communication case against it was closed in February 2025.

The transposition gold-plates one provision in a way that matters to anyone selling awareness training. The Directive requires Member States to encourage entities to offer similar training to their employees on a regular basis. The Greek article requires entities to ensure that they provide similar training to their employees at least on an annual basis. Encouragement became an obligation and regular became annual. The risk-management article separately reproduces basic cyber hygiene practices and cybersecurity training verbatim.

None of that reaches simulation. We counted the transposing law through for phishing, voice phishing, the Greek word for phishing, simulation and social engineering, and all of them return zero. The binding implementing framework of May 2025 returns the same zeros with one exception worth quoting precisely: social engineering appears once, as training content, and in the phrase about ways of dealing with deceptive and social engineering messages. Messages. Voice is not named anywhere in the Greek stack.

For financial entities the European digital operational resilience Regulation applies directly and the central bank is the competent authority for the entities it supervises. The Regulation makes information and communications technology security awareness programmes and resilience training compulsory modules in staff training schemes, and requires threat-led penetration testing of live production systems every three years for identified entities. It contains no occurrence of social engineering or of phishing.

The delegated regulation on that testing is where social engineering finally appears, and as elsewhere it appears as a governance requirement rather than a mandate: the red team test plan must state the ethical boundaries for social engineering. That tells you how to do it if you do it. It does not tell you to.

One negative worth stating because vendors imply otherwise. There is no Greek national threat-led testing framework. Greece is absent from the European central bank's list of adopting jurisdictions and the Greek central bank's own material on the Regulation contains no reference to one.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in GREECE. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored and no call is recorded. The workforce is informed in advance at the programme level.

Verify or correct each proposition below against primary Greek sources, and tell me who inside our Greek entity has to agree:

1. ⚠ ΠΚ 370Α as restated by Ν. 5002/2022 άρθρο 10 makes recording your OWN telephone call without the other party's express consent a FELONY (κάθειρξη up to 10 years), and παρ. 3 deleted «αθέμιτα» so mere use carries the same ceiling. ⚠ The 2019 Criminal Code text reads cleanly and is out of date.
2. Σύνταγμα άρθρο 19 παρ. 3 bars the use of evidence obtained in breach, so a recording made in breach is unusable in the disciplinary process it was made for.
3. ⚠ Ν. 1767/1988 άρθρο 12 παρ. 4 ε΄ makes «τον τρόπο ελέγχου της παρουσίας και της συμπεριφοράς του προσωπικού» a JOINT DECISION with the works council, in a written agreement with κανονιστική ισχύ. Assess whether a vishing simulation is that, and identify which body now discharges the abolished prefectural deadlock function.
4. Ν. 4624/2019 άρθρο 27 sets an «απολύτως απαραίτητη» standard and makes consent exceptional. Confirm no Greek source positively endorses Art 6(1)(f) for employee monitoring.
5. HDPA Οδηγία 115/2001 survives «εφόσον δεν αντίκειται» under άρθρο 83. Confirm it is neither current guidance nor a dead letter.
6. Ν. 3471/2006 άρθρο 11 is scoped to commercial promotion and advertising, so an internal test is outside it; the opt-out register is per operator, not national.
7. Ν. 5321/2026 άρθρα 3 and 23: the HDPA supervises Arts 5 and 50, and stripping the Art 50 markings or disclosure is criminal.
8. ΕΕΤΤ ΑΠ 1175/3 requires rejection of inbound international calls with a +302 CLI, and ΑΠ 938/2 requires the provider to verify right of use before activating CLI.

Flag anything that has changed since September 2026, and identify any obligation in our own collective agreement that this analysis omits.

Common questions

Can we record a simulation call in Greece?: Practically no. Since December 2022 recording your own telephone conversation without the other party's express consent is a felony carrying up to ten years, and the Constitution separately bars using evidence obtained in breach. Design Greek exercises to produce outcomes rather than audio.
Do Greek works councils have a say over monitoring?: Where one exists, a decisive one. The manner of monitoring the presence and conduct of personnel is decided jointly with the employer, recorded in a written agreement with normative force, and deadlock goes to an administrative committee rather than resolving in the employer's favour.
Will calls from our platform abroad reach Greek staff?: Not with a Greek caller identity. Calls entering Greek networks from an international interconnection while presenting a Greek country code are rejected outright, with narrow technical carve-outs for roaming and forwarding. Originate inside Greece, on a number whose right of use the provider has verified.
Who enforces the AI disclosure duty in Greece?: The data protection authority, designated in July 2026 for both the prohibited practices and the transparency article. The same law makes it a criminal offence, punishable by imprisonment and a fine, to remove the required markings or to remove or obstruct the deepfake disclosure.

Elsewhere in Southern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.