Greece:
What your customers there expect

Greece as a market for South America

According to Eurostat, Greece imported goods worth around EUR 1 billion from Argentina, Bolivia, Brazil, Chile, Ecuador, Colombia, Paraguay, Peru and Uruguay in 2025. The largest suppliers were Brazil (EUR 0.4 billion), Argentina (0.27 billion) and Ecuador (0.23 billion). Goods worth just under EUR 0.2 billion went the other way.

The list of goods is short and agricultural: soybean meal from Argentina for livestock (around EUR 0.19 billion), bananas from Ecuador (0.17 billion), coffee from Brazil (0.17 billion), plus soybeans and raw tobacco from Brazil and shrimp from Ecuador. If you supply soy, coffee or beef, keep your EUDR documentation ready.

With 4.7 million TEU in 2024, Piraeus is one of the largest container ports in the EU (Eurostat). Not every container that arrives there stays in Greece; for customs purposes, what counts is where your goods are released into free circulation in the EU.

What applies EU-wide and what is Greek

Customs, rules of origin, product safety and food law are EU law and the same everywhere; the basics are in the guide to exporting to the EU. The main national differences:

• Language: EU law allows each member state to set the language of mandatory food information (Art. 15 of Regulation (EU) 1169/2011). In Greece, expect Greek on labels and instructions, and sort out the translation early with your importer.
• Packaging: like all EU states, Greece has an extended producer responsibility system for packaging. Since August 12, 2026, the EU Packaging Regulation (EU) 2025/40 applies as well.
• VAT: standard rate 24 %, reduced rates 13 % and 6 %. Lower rates apply on some islands.

NIS2 in Greece

Greece transposed the NIS2 Directive with Law 5160/2024 (Government Gazette ΦΕΚ Α' 195 of November 27, 2024). It has applied since that day. The competent authority is the National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας), which also runs the CSIRT for incident reports. The registration deadline for entities in scope expired on September 30, 2025.

The minimum requirements are set out in a joint ministerial decision, ΚΥΑ 1689/2025 of May 2025. Article 12 matters for suppliers: covered entities keep a list of their suppliers and include security clauses in their contracts. On top of that come external penetration tests at least once a year and a dedicated IT security officer, who may not also be the data protection officer.

Significant incidents must be reported within 24 hours as an early warning, the notification follows after 72 hours and the final report one month later. Your Greek customer will therefore write a shorter deadline into your contract.

The law also holds management accountable. Management bodies approve the security measures, oversee their implementation and take part in training; staff are trained at least once a year. Violations of the obligations on measures and reporting can cost essential entities up to EUR 10 million or 2 % of worldwide annual turnover, and important entities up to EUR 7 million or 1.4 %. For essential entities, the authority can also inspect without cause, on site and with security scans.

Data protection and supply chain

The GDPR is supervised by the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority). Supplementary rules are in Law 4624/2019. In a cyber incident involving personal data, the cybersecurity authority informs the data protection authority; the notification under Art. 33 GDPR nonetheless remains a separate obligation of your customer.

Greece has no supply chain law of its own. The CSDDD will be the relevant rule, to be transposed by July 26, 2028.

What Greek customers typically ask for

Feed mills and food retailers ask for traceability, lab analyses and a certificate under IFS, BRCGS or FSSC 22000. For soy from Argentina or coffee from Brazil, the geolocation data for the EUDR comes on top.

IT service providers working for Greek banks, energy utilities or shipping companies get questions that come straight from ΚΥΑ 1689/2025: Do you run penetration tests? Who is responsible for incidents? How is access to customer systems protected? An ISO 27001 certificate makes the answers easier. Between penetration tests, an external attack surface check with veyrisk shows which of your services are reachable from the internet and whether known vulnerabilities are open. For industrial customers, ISO 9001 is the usual baseline.

Contacts

• Enterprise Greece, the government agency for investment and foreign trade.
• The Athens Chamber of Commerce and Industry (Εμπορικό και Βιομηχανικό Επιμελητήριο Αθηνών) and the regional chambers, for example in Thessaloniki and Piraeus.
• The trade section of your country's embassy in Athens.
• The Enterprise Europe Network in Greece.
• Greek Customs, part of the Independent Authority for Public Revenue (ΑΑΔΕ).

Since May 1, 2026, the EU-Mercosur Agreement has applied provisionally to goods from Mercosur. You only get the tariff reduction with a statement on origin on the invoice; check with your importer in Piraeus or Thessaloniki which details Greek customs wants to see.

FAQ