Resources / Guide
The ΥΑΣΠΕ: who can be one and what they do
Updated 24 October 2026
Every essential and important entity under Law 5160/2024 appoints a security officer for information and communication systems (ΥΑΣΠΕ). ΥΑ 1899/2025, in force since 1 November 2025, sets their qualifications, disqualifications, incompatibilities and duties[1].
Who can be the ΥΑΣΠΕ?
- A member of the entity's own staff. As an exception, a member of staff of another entity in the same group (Article 3)[1].
- With sound knowledge of the entity's business processes and one of the following: a degree or a postgraduate title of at least one year in a related field; 5 years' expertise in information security or cybersecurity; or certified knowledge of security methods and standards together with 2 years' expertise (Article 4(1))[1].
- With no final conviction for the offences Article 4(2) lists, and the entity asks for a copy of the criminal record[1].
Who cannot be the ΥΑΣΠΕ?
The ΥΑΣΠΕ's duties are incompatible with those of the data protection officer (DPO) and of the person responsible for the entity's IT, communications and e-government (Article 4(3))[1].
That is why a consultancy cannot be an entity's ΥΑΣΠΕ, and the head of IT as a rule cannot either. A consultant can support the ΥΑΣΠΕ the entity appoints.
What does the ΥΑΣΠΕ do?
- Looks after the security of the systems continuously and oversees the measures being put in place.
- Handles every communication with Greece's National Cybersecurity Authority (ΕΑΚ).
- Coordinates compliance with Article 15 of Law 5160/2024 and KYA 1689/2025, and with incident reporting under Article 16.
- Oversees the entity's cybersecurity policy being applied.
The duties of Article 6 of the decision include these and more[1]. The ΥΑΣΠΕ reports directly to the management body (KYA 1689/2025, Article 7)[2].
How do you appoint and declare the ΥΑΣΠΕ?
The entity declares the ΥΑΣΠΕ on the ΕΑΚ's registration platform (Article 8)[1], checks their background before they start (Article 5) and reviews their qualifications periodically (Article 3(2))[1].
How Vardion supports the ΥΑΣΠΕ
- The appointment is recorded as an ISMS record: name, date of appointment, whom they report to and where the decision is kept.
- Their name goes into the KYA policy drafts.
- The security officer support package for partners works with the ΥΑΣΠΕ the entity appoints.
See your first 90 days as ΥΑΣΠΕ, with every duty of Article 6.
What to do now
- Appoint a ΥΑΣΠΕ from your own staff who is not the DPO or the head of IT.
- Ask for a copy of the criminal record and record the background check.
- Declare them on the ΕΑΚ's platform.
Sources
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 2 November 2026
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
Organise the ΥΑΣΠΕ's work in Vardion
The appointment, the policies, the ΕΑΚ assessments and the deadlines, on sample data.