Country：希腊 · Employment & Visas
Greece · Employment & Visas
Non-EU employees need a Type D visa (long-stay work visa) and, after arrival, must apply for a 'residence permit for dependent employment' (Article 15). This permit itself serves as the work permit; the employer must prove the position cannot be filled by Greek or EU citizens. The EU Blue Card requires annual salary of at least 1.5× the Greek average (about €27,000+). The 2025 statutory minimum wage is €880/month. Social security is administered by EFKA; employer burden about 25-30%.
Key points
- Non-EU: Type D visa (90+ days work) + residence permit for dependent employment (Article 15, i.e. work permit).
- EU Blue Card: 1-year contract, salary ≥1.5× Greek average, family members can accompany.
- ICT intra-corporate transfer (Type E.2): managers or specialists up to 3 years, trainees 1 year.
- 2025 minimum wage €880/month (with seniority increments), plus 13th and 14th salaries.
- Social security EFKA: employer about 25-30%, employee about 22-27%.
- Standard 40 hours/week; overtime paid at 140-175% of normal.
Procedure
- Employer applies to the migration authority for work permit approval (proving local shortage).
- Employee applies for the Type D visa in their home country.
- Apply for the residence permit for dependent employment within 30 days of arrival.
- Complete EFKA social security registration and withhold payroll tax.
Hard requirements
- Employment contract (meeting minimum wage); local-shortage proof; AFM/AMKA.
Costs
Visa and permit fees; social security and payroll tax.⏱ ⏱ Timeline：Residence permit approval usually 6-12 months; plan early.⚠ Common risks
- Residence permit approval is slow (6-12 months), may affect onboarding.
- Greek-language documents and certified translation requirements.
- Late renewal after expiry leads to penalties and affects legal status.
Handbook
📘 Step-by-Step Handbook (with owner / timeline / cost / penalties)
Applies to：Chinese enterprises in Greece employing non-EU staff (including Chinese secondees), applying for work permits and residence, and fulfilling employer social security and payroll compliance.
Prerequisites
- Greek entity registered (GEMI+AFM)
- Employment contracts meet minimum wage (€880/month in 2025)
- Local-shortage proof (labour ministry quota/satisfaction proof)
- Employee AFM/AMKA (social security number)
| Step | Action | Owner | Timeline | Cost | Official form / system | Notes & penalties |
|---|---|---|---|---|---|---|
| 1 | Employer applies for work permit approval (proving local shortage) Prove to the labour/migration authorities that the position cannot be filled by Greek/EU citizens; obtain employment quota or satisfaction proof | Employer/law firm | Weeks to months | Application fees | Work permit application | Precondition for non-EU hiring Penalty：Hiring without permit is penalized |
| 2 | Employee applies for the Type D long-stay visa (work purpose) in their home country Apply for a Type D (90+ days work) visa at the Greek consulate in the country of residence with the work permit approval | Employee/consulate | Weeks | Visa fees | Type D visa application | Must be completed before arrival in Greece Penalty：Entering without a visa is a violation |
| 3 | Apply for the residence permit for dependent employment within 30 days of arrival (Article 15) File the residence permit for dependent employment under Article 15 of Law 4251/2014; the permit itself is deemed a work permit | Employee/migration authority | Approval usually 6-12 months | Permit fees | Residence permit application (Migration Code) | Long approval cycle; plan onboarding early Penalty：Late filing affects legal status |
| 4 | EFKA social security registration and payroll tax withholding Obtain AMKA, file and pay social security monthly via DPD, and withhold payroll tax | Employer or accountant | At hiring | Social security rates (employer about 21.8%-22.3%, employee about 13.4%-13.9%, 2025 rates) | EFKA registration and monthly filing (DPD) | Rates per the latest EFKA announcements Penalty：Late payment generates interest and fines |
| 5 | EU Blue Card or ICT secondment (if applicable) Blue Card requires a 1-year contract and salary ≥1.5× the Greek average (about €27,000+, per schedule); ICT applies to intra-group managers or specialists | Employer or migration authority | By type | Application fees | Blue Card or ICT (E.2) application | Family members can accompany (Blue Card holders) Penalty：Non-qualification leads to rejection |
| 6 | Renewal and compliance Plan renewal 2 months before permit expiry; maintain genuine employment and minimum wage | Employer or employee | Continuous | Renewal fees | Renewal application | Annual labour compliance and working-time records Penalty：Late renewal after expiry: fines and impact on residence status |
✅ Self-check list
⚠ Common pitfalls
Slow residence permit approval (6-12 months) affects onboarding影响：Employees cannot work legally规避：Plan early and prepare visas in parallel
Greek-language documents and certified translation requirements影响：Delay规避：Prepare certified translations early
Permit not renewed before expiry影响：Penalties and impact on legal status规避：Build a 2-month-before-expiry reminder mechanism
Social security rate discrepancies (employer 21.8%-22.3%)影响：Under-accrual recovery规避：Follow latest EFKA announcements; file DPD monthly
Working on a tourist visa影响：Illegal work penalized/deported规避：Must hold a Type D visa and residence permit
Minimum wage/13-14 salary omissions影响：Labour lawsuits and fines规避：Contracts must include statutory bonuses
📅 Ongoing post-incorporation obligations
- EFKA monthly social security filings (DPD) and payroll tax withholding
- Renew residence permits before expiry
- Maintain genuine employment and minimum wage
- Annual labour compliance and working-time records
- Continuously satisfy Blue Card/ICT conditions
🔗 Official portals
用工数据子模板
🔐 Employee Personal Data — GDPR Obligations (EU)
Benchmarked against the twin landmines Deel / Remote / Papaya-style EOR platforms keep hitting — 'worker misclassification + cross-border employee data'. This checklist turns the scattered GDPR employee-data obligations into do-this steps, not statute recitals.
Hiring an employee in any EU country (including via an EOR nominal employer, or by mislabeling someone as a contractor) triggers the full set of GDPR obligations over employee personal data. If the Chinese parent can access EU employee data, cross-border transfer (SCC) obligations stack on top. Misclassification does not change where data-protection responsibility sits under the factual employment relationship.
触发场景：Hiring employees in any EU country (DE / ES / GR), including via an EOR nominal employerMonitoring employees (attendance, email, CCTV, productivity software, GPS / field tracking)Transferring EU employee data back to China HQ or any non-adequacy third countryProcessing sensitive / special-category data (health, race, union, biometrics)Using contractors / freelancers who are in fact managed and controlled (misclassification risk)
Handbook
📘 Step-by-Step Handbook (with owner / timeline / cost / penalties)
Applies to：EU-member-state employers, EOR nominal employers, and Chinese parent / affiliate companies that can access EU employee data (as joint controllers or recipients).
Prerequisites
- Confirm the employment law relationship: employee / contractor / EOR — this decides who the current GDPR controller is
- Map the employee-data flow (collection points, storage location, whether it leaves the EU to China)
- If the Chinese company has no EU establishment, appoint an EU Representative under Art.27
| Step | Action | Owner | Timeline | Cost | Official form / system | Notes & penalties |
|---|---|---|---|---|---|---|
| 1 | Establish the legal basis for processing (Art.6) Do NOT rely on 'consent' as the primary basis for employee data (power imbalance makes it easily invalidated); use 'necessary to perform the contract', 'legal obligation', or 'legitimate interests' with a documented LIA balancing test. | DPO / HR + Legal | Finalize before onboarding | 0 | Records of Processing Activities (RoPA) | Penalty：Wrong basis: fines up to 2% of global annual turnover or €10M (whichever is higher) |
| 2 | Issue the Employee Privacy Notice (Art.13/14) Provide employees a privacy notice: purposes, legal basis, data categories, retention, cross-border transfer arrangements and how to exercise rights; in EOR setups disclose the joint-controller relationship and respective roles. | HR | On the first day of employment | 0 | Employee Privacy Notice | Penalty：Lack of transparency is a frequent enforcement trigger |
| 3 | Special-category data assessment (Art.9) Health, race, union membership, biometrics are prohibited in principle; if genuinely needed, rely on an explicit exemption and apply technical isolation and least-access. | DPO | Before processing | 0 | Data classification inventory | Penalty：Special-category breaches carry heavier fines (4% / €20M) |
| 4 | Employee monitoring & DPIA (Art.35) Any systematic monitoring (CCTV, email review, productivity tracking, GPS) requires a Data Protection Impact Assessment (DPIA); high-risk processing must be consulted with employee representatives / works council first. | DPO + Employee representatives | Before monitoring goes live | 0 | DPIA report | In Germany, consult the Betriebsrat (works council) in parallel Penalty：Failure to run a DPIA is a standalone penalty item |
| 5 | Cross-border transfer to China (Chapter V) China is not an adequacy country; transfers to HQ require Standard Contractual Clauses (SCC) plus a Transfer Impact Assessment (TIA), with supplementary measures (encryption / pseudonymization) where needed. | DPO + China Legal | Before first transfer | 0 | SCC + TIA | Mirrors the 'China data export' obligations in the data dimension Penalty：Unlawful transfer: fines 4% / €20M |
| 6 | Respond to employee data-subject rights (Art.15-22) Operate an access / rectification / erasure / portability / restriction (DSAR) channel, respond within 1 month; handle post-exit retention per policy. | DPO | Ongoing | 0 | DSAR workflow | |
| 7 | Appoint DPO and EU Representative (Art.37/27) If core activities involve large-scale systematic monitoring or special-category processing, appoint a Data Protection Officer (DPO); a Chinese company without an EU establishment must appoint an EU Representative. | Management | Before processing activities start | 0 | DPO appointment / EU Rep agreement |
✅ Self-check list
⚠ Common pitfalls
Relying on 'employee consent' as the processing basis影响：Under power imbalance, consent can be invalidated by the regulator, breaking the lawfulness of the entire processing chain规避：Use contract performance / legal obligation / legitimate interests, and keep the LIA on file
Mislabeling an employee as a contractor to dodge employer duties (Deel-type misclassification)影响：Under the factual employment relationship, both GDPR employee-data duties AND labor-law employer liability return; misclassification also triggers tax back-pay, social-insurance recovery and heavy fines规避：Determine the relationship by 'factual control'; in EOR setups sign a joint-controller agreement and clarify data flow and respective duties
China HQ reads EU employee data directly with no SCC影响：Constitutes an unlawful cross-border transfer, fines 4% / €20M规避：Sign SCC + complete TIA, with encryption / pseudonymization as supplementary measures
Monitoring employees without DPIA or works-council consultation影响：In high-regulation countries like Germany, easily triggers complaints and penalties, and poisons labor relations规避：Run DPIA before monitoring + consult the Betriebsrat / employee representatives
Unclear retention of ex-employee data影响：Over-retention violates the data-minimization principle规避：Define a retention schedule and destroy / archive on time
📅 Ongoing post-incorporation obligations
- Maintain RoPA (records of processing activities) continuously
- Re-assess transfer measures every 12 months
- Keep the data-subject rights channel running as business-as-usual
- Re-run DPIA on material processing changes (new system / new monitoring)
🔗 Official portals
📎 Source：GDPR (Reg. 2016/679) Art.6/9/13/27/30/33/35/37/44; EDPB employee-monitoring guidance; Germany BDSG and Betriebsrat co-determination rules. This card is an operational checklist, not legal advice — rely on counsel and official publications for implementation.
📎 Source：Greek Directorate of Migration; Law 4251/2014 Article 15; EFKA Social Security Agency
Want to turn this into an actionable compliance workflow?
CompliGo · Outbound Compliance Automation
You now have the essentials. Hand it to CompliGo: auto-generate compliance documents, real-time validation, and one-click regulatory alerts. Free trial for new users.
CompliGo is an independent SaaS operated by the outbound team. This knowledge base only drives acquisition and never handles funds or collects/pays on your behalf.