Is cold email legal in Greece? B2B rules for 2026

No, not without prior consent. Article 11 of Greece's Law 3471/2006 allows marketing email only with the recipient's prior express consent, and paragraph 7 applies that rule to legal persons, so a company's info@ address needs consent too. Named employees and sole traders need consent as well; the only exception covers your own customers. In December 2024 the Hellenic Data Protection Authority (HDPA) fined a company €10,000 for one sales email to another company's contact address; the sender had also ignored the regulator.

Checked on 25 October 2026 against the law text, the HDPA's guidance and its decisions. This is not legal advice.

Greece is as strict as Italy, Spain and Germany. All countries: cold email laws by country.

Greece at a glance

What the law says

Law 3471/2006 implements the EU's ePrivacy Directive. Article 11(1), as the HDPA quoted it in decision 7/2026 of 2 June 2026, and paragraph 7:

«Η χρησιμοποίηση αυτόματων συστημάτων κλήσης, ιδίως με χρήση συσκευών τηλεομοιοτυπίας (φαξ) ή ηλεκτρονικού ταχυδρομείου, και γενικότερα η πραγματοποίηση μη ζητηθεισών επικοινωνιών με οποιοδήποτε μέσο ηλεκτρονικής επικοινωνίας, χωρίς ανθρώπινη παρέμβαση, για σκοπούς απευθείας εμπορικής προώθησης προϊόντων ή υπηρεσιών και για κάθε είδους διαφημιστικούς σκοπούς, επιτρέπεται μόνο αν ο συνδρομητής συγκατατεθεί εκ των προτέρων ρητώς»

«7. Οι ανωτέρω ρυθμίσεις ισχύουν και για τους συνδρομητές που είναι νομικά πρόσωπα.»

Our translation: "The use of automated calling systems, in particular by fax or electronic mail, and more generally the making of unsolicited communications by any means of electronic communication, without human intervention, for the direct marketing of products or services and for any kind of advertising, is permitted only if the subscriber has given prior express consent." And: "7. The above provisions also apply to subscribers who are legal persons."

The directive requires consent only for "subscribers who are natural persons" (Article 13(5)); Greece went further, and its law defines a subscriber as "κάθε φυσικό ή νομικό πρόσωπο" (any natural or legal person) with a communications contract (article 2).

From 1 September 2011, Law 3917/2011 deleted "με ή" ("with or") before "without human intervention" and rewrote the first sentence of paragraph 2, making live phone calls opt-out; Law 4070/2012 renumbered the legal-persons clause from paragraph 5 to 7 (older copies online still show 5). Paragraph 4 requires every marketing email to name the sender and give "μια έγκυρη διεύθυνση" (a valid address) for stop requests. Sources: the consolidated text on the HDPA's legislation page. In our reading, article 11 is unchanged since 2012; HDPA decisions from 2022 to 2026 quote the same wording.

What the regulator says

The HDPA enforces article 11. Its guidance calls prior consent "Βασική προϋπόθεση" (the basic precondition) for email, SMS, instant messaging and messages on social networking sites (HDPA). Its page on senders' obligations adds (our translation; HDPA):

• Without a previous transaction, "before sending any message you must have obtained their consent in writing or electronically".
• Addresses harvested online from websites, "for example when they contain ... shared company contact addresses like «info@company.gr»", social networks or online directories, "whether the collection is done manually or automatically", or taken from directories such as trade fair catalogues, may not be used.
• The rules apply to manual and automated sending alike, and you stay accountable when an agency sends for you.

It also asks you to mark the commercial nature in the subject line (Presidential Decree 131/2003).

Named employees, sole traders and the first email

• Named employees: every subscriber is protected, so firstname.lastname@ needs consent like info@. For a company address the HDPA held that "θα έπρεπε να υπάρχει συγκατάθεση του νομικού προσώπου" (the legal person's consent was required) (30/2022). We found no guidance on whose consent counts for a named work address; the cautious choice is the person's own.
• Sole traders: natural persons, so consent. When a pharmacy-supplies wholesaler emailed a pharmacist who runs two pharmacies (the decision does not give his legal form), the HDPA held that holding someone's business card does not show "the consent of the person" on it (24/2023, our translation).
• The first email: not allowed. The guidance says an "invitation e-mail" to obtain consent "should not be used", and Directive 2/2011 says the consent rule covers "ακόμα και" (even) an initial message that urges the recipient to consent (recital 2; also article 8(1)).

LinkedIn and social media messages

The HDPA's guidance lists "social networking sites, e.g. Facebook, Twitter, Myspace" among the channels that need consent; LinkedIn is not named. In decision 30/2022 a company emailed seminar offers to someone its legal representative had been connected to on LinkedIn since 2016. The HDPA held that contact details "may be available among the members of the network, but only for purposes directly related to it and not for promoting services" (our translation). That case was about email; in our reading a LinkedIn sales DM to a recipient in Greece needs consent too. We found no guidance on connection requests with a sales note.

GDPR and the HDPA

• Company addresses: an address with no person behind it may fall outside GDPR, but article 11 still applies: in 52/2024 the address was not linked to any natural person, and the HDPA still found a breach.
• Legitimate interest: a training institute took the contact details of about 1,000 self-employed professionals (its own figure) from online directories such as Χρυσός Οδηγός and called them. The HDPA held that Article 6(1)(f) could not be the basis, since the use did not match the purpose of publication, found that not informing them breached Article 14, and fined it €5,000, which also covered an article 11 breach (35/2021).
• Objection: people may object "at any time" under Article 21(2), and the advertiser must stop (HDPA FAQ).
• Law 4624/2019, Greece's GDPR law, repealed Law 2472/1997 but kept its article 21 for sanctions under Law 3471/2006 (article 84, text).

More in GDPR and B2B email under legitimate interest.

Fines and real cases

Article 13(4) points to article 21 of Law 2472/1997: sanctions from a warning to a fine of 300,000 to 50,000,000 drachmas (about €880 to €146,735 at the fixed rate of 340.750, our conversion), and destruction of the address file. In decision 7/2026, however, the HDPA fined article 11 breaches under GDPR Article 58(2)(i) (as in 8/2025), while 52/2024 still applied article 21; in our reading the maximum is therefore unsettled. Recipients can also sue: article 14(2) sets non-pecuniary damages at no less than €10,000 unless the claimant asks for less.

B2B decisions:

• Wedoo Digital Agency, 52/2024, 18 December 2024: one email offering digital marketing services to a company's central contact address. €10,000, after the sender ignored the HDPA (PDF).
• Global Greece ΜΕΠΕ, 30/2022, 5 July 2022: the seminar email above and an email selling prospect lists to a company address. €3,000; the same company was fined €5,000 in 2013.
• Email-marketing sole trader, 50/2017, 12 May 2017: addresses from sources including ICAP's list of businesses, Hellasstat, trade fair catalogues and bought lists, one campaign reaching 529,773 addresses. €75,000, also for tracking pixels (PDF).

The pharmacist case (24/2023, 12 June 2023) ended with a reprimand and a warning. For scale, in B2C cases: €45,000 for text messages (8/2025) and €230,000 on the electricity supplier PPC for marketing calls (7/2026, PDF).

Checklist for B2B email to Greece

1. Get prior consent before the first marketing email, company addresses included, and keep a record; Directive 2/2011 describes double opt-in.
2. Do not treat a published address, a business card, a directory or a LinkedIn connection as consent.
3. Do not email to ask for consent.
4. Use the customer exception only for your own similar products, with an opt-out every time.
5. Name the sender, give a stop address and mark the email as commercial in the subject line.
6. Demand proof of consent behind any bought list, inform people under Article 14 and keep a suppression list.

How Leo handles Greece

Revexa, which publishes this guide, builds Leo, a buying-signal agent. Leo automatically blocks cold messages only to leads in Germany, not to leads in Greece. In review mode, the default, you read and approve every draft before it is sent, so whether a Greek lead has consented is yours to check before you approve. Leo writes in the lead's own language when your website exists in that language (Greek, if your site has a Greek version), otherwise in English. Leo is the wrong choice if you need software that enforces Greece's consent rule for you.

More countries: Czech Republic, Estonia, Hungary and Romania.

Common questions

Is B2B cold email legal in Greece?

No. Article 11 of Law 3471/2006 requires prior express consent for marketing email, and paragraph 7 applies it to companies too. The only exception is your own similar products for existing customers.

Can I email a Greek company's info@ address without consent?

No. In December 2024 the HDPA fined a company €10,000 for one sales email to another company's central contact address, not linked to any person; the sender had also ignored the regulator.

Can I send a first email asking for consent in Greece?

No. HDPA guidance says invitation emails to obtain consent should not be used, and its Directive 2/2011 says the consent rule covers even a first message asking for consent.

Can I send cold LinkedIn messages to prospects in Greece?

In our reading, treat them like email. HDPA guidance covers messages on social networks, and in 2022 the HDPA held that a LinkedIn connection does not allow marketing emails. We found no decision on LinkedIn messages themselves.

What are the fines for cold email in Greece?

The old scale runs up to 50 million drachmas (about €146,735, our conversion), but in 2026 the HDPA fined an article 11 breach €230,000 under its GDPR powers. Recipients can also sue.