Recruit
Greece applies the GDPR to recruitment, and its data protection authority has been active in enforcing limits on employers who collect more than a role requires. Criminal record checks are possible but should not be routine.
Criminal record checks
The candidate obtains a copy of their criminal record from the public prosecutor’s office or through a citizens’ service centre, and increasingly through the state’s digital services. Employers cannot access the record directly. There are different versions depending on purpose, with the one issued for general use showing a narrower set of convictions. A check is justified where the role warrants it, covering banking and finance, private security, education, childcare, healthcare, and positions with access to significant assets.
What employers can check
Identity, right to work, employment history, and academic qualifications are all legitimate. Degrees from outside Greece generally need recognition before they can be relied on for regulated professions, and many professions require registration with a chamber or association.
Data protection
The GDPR applies alongside Greek implementing law, supervised by the Hellenic Data Protection Authority. Conviction data attracts additional protection and cannot be processed simply because a candidate consents, since consent is treated as a weak basis in the employment context. Collect the minimum, be transparent about purpose, and delete unsuccessful applicants’ data once recruitment closes rather than retaining CVs indefinitely.
Health checks
Pre-employment health certificates are required for specific sectors, particularly food handling and roles with public health implications. Beyond those, health enquiries during recruitment are difficult to justify.
Practical guidance
Decide role by role whether a criminal record copy is justified and document the reasoning, view rather than retain where possible, and set a retention period for applications. An employer of record can manage this if you have no Greek entity.
