HDPA Greece: AFM and AMKA Detection
Updated for 2026
Greece's data protection authority (HDPA) issued 89 enforcement decisions in 2024. That is a 162% rise from 34 decisions in 2022. Tourism drives 38% of HDPA cases. Maritime operations add further risk.
See the GDPR compliance guide for context on national DPA enforcement.
AFM: Tax Registration Number
The ΑΦΜ is a 9-digit tax number. Every citizen, resident, and business holds one.
Checksum: Multiply digits 1–8 by weights 256, 128, 64, 32, 16, 8, 4, and 2. Sum the products. Take modulo 11. If the result is 10, the number is not valid. Otherwise, the check digit is the result modulo 10.
The AFM appears on invoices, contracts, and government forms. It is the primary ID for both people and businesses in the country.
Detection gap: Generic NLP tools find the AFM with only 52% accuracy (HDPA 2024). Three causes explain this. First: the 9-digit format looks like many reference numbers and date parts. Second: the two-step modulo checksum is missing from most generic tools. Third: the number often has no label — it sits inside an address block.
For more on structured IDs, see the entities reference.
AMKA: Social Insurance Number
The ΑΜΚΑ is an 11-digit number. Digits 1–6 encode the birth date in DDMMYY format. Digit 7 encodes gender: odd for male, even for female. Digits 8–11 form the serial number and check digit.
This design is similar to Sweden's personnummer. Both raise the same GDPR concern. The number reveals biological sex as a data point.
The AMKA appears in health records, social security files, and payroll. Every citizen and resident holds one. It acts as the main number for health care and benefits. See the security and compliance page for how GDPR applies to this data type.
Script Support Gap
Hellenic text uses a different script from Latin languages. This is a core challenge for PII tools.
Unicode ranges: Hellenic characters sit in U+0370–U+03FF and U+1F00–U+1FFF. Tools built only for ASCII or Latin scripts will not process these characters.
NER model: spaCy's el_core_news model handles Hellenic NER. But it needs explicit setup. Most default pipelines use English only. They produce no output on Hellenic-script documents.
Mixed-script files: Documents in the country often mix Hellenic and Latin script. Brand names and technical terms appear in Latin. Body text is in Hellenic. A pipeline must handle both.
Case forms: Names shift form in Hellenic sentences. Γεώργιος Παπαδόπουλος in subject form becomes Γεωργίου Παπαδόπουλου in genitive. A tool needs morphological analysis to catch both.
See the FAQ for questions about multilingual PII detection.
Tourism Compliance Risks
Tourism drives 38% of HDPA cases. Scale and seasonality create the main risks.
PMS retention: Hotel systems collect passport numbers, birth dates, and contact data. HDPA found many systems keep this data for five or more years. Most had no stated purpose. Most had weak security controls.
Payment data: Hotels process card data from local and foreign guests. Folios hold partial card numbers. Booking systems hold full card details. Both PCI DSS and GDPR apply.
Seasonal staff: Hospitality staff often work 4–6 month contracts. HDPA found many cases where access was not removed when staff left. This gap is common in high-turnover sectors.
Technical Checklist for HDPA Compliance
For processing documents in the Hellenic language, use this minimum stack. AFM detection needs two-step modulo checksum validation. AMKA detection needs birth-date and gender-digit parsing. Add Hellenic-script NER via spaCy el_core_news. Include passport and national ID detection in both scripts.
For tourism operators, two organizational steps are also needed. First: document PMS data retention periods. Second: remove system access when seasonal staff leave. These steps address the most common HDPA findings.
See pricing for API plans that fit document-heavy hospitality workflows.
anonym.legal detects AFM and AMKA with full checksum validation. It supports Hellenic-script NER via the spaCy el_core_news pipeline.