Resources / Guide
The ΥΑΣΠΕ: who can be one and what they do
Updated 24 October 2026
Every essential and important entity under Law 5160/2024 appoints a security officer for information and communication systems (ΥΑΣΠΕ). ΥΑ 1899/2025, in force since 1 November 2025, sets their qualifications, disqualifications, incompatibilities and duties[1].
Who can be the ΥΑΣΠΕ?
- A member of the entity's own staff. As an exception, a member of staff of another entity in the same group (Article 3)[1].
- With sound knowledge of the entity's business processes and one of the following: a degree or a postgraduate title of at least one year in a related field; 5 years' expertise in information security or cybersecurity; or certified knowledge of security methods and standards together with 2 years' expertise (Article 4(1))[1].
- With no final conviction for the offences Article 4(2) lists, and the entity asks for a copy of the criminal record[1].
Who cannot be the ΥΑΣΠΕ?
The ΥΑΣΠΕ's duties are incompatible with those of the data protection officer (DPO) and of the person responsible for the entity's IT, communications and e-government (Article 4(3))[1].
That is why a consultancy cannot be an entity's ΥΑΣΠΕ, and the head of IT as a rule cannot either. A consultant can support the ΥΑΣΠΕ the entity appoints.
What does the ΥΑΣΠΕ do?
- Looks after the security of the systems continuously and oversees the measures being put in place.
- Handles every communication with the ΕΑΚ.
- Coordinates compliance with Article 15 of Law 5160/2024 and KYA 1689/2025, and with incident reporting under Article 16.
- Oversees the entity's cybersecurity policy being applied.
The duties of Article 6 of the decision include these and more[1]. The ΥΑΣΠΕ reports directly to the management body (KYA 1689/2025, Article 7)[2].
How do you appoint and declare the ΥΑΣΠΕ?
The entity declares the ΥΑΣΠΕ on the ΕΑΚ's registration platform (Article 8)[1], checks their background before they start (Article 5) and reviews their qualifications periodically (Article 3(2))[1].
How Vardion supports the ΥΑΣΠΕ
- The appointment is recorded as an ISMS record: name, date of appointment, whom they report to and where the decision is kept.
- Their name goes into the KYA policy drafts.
- The security officer support package for partners works with the ΥΑΣΠΕ the entity appoints.
What to do now
- Appoint a ΥΑΣΠΕ from your own staff who is not the DPO or the head of IT.
- Ask for a copy of the criminal record and record the background check.
- Declare them on the ΕΑΚ's platform.
Sources
- ΥΑ 1899/2025 (ΦΕΚ Β' 4250/5.8.2025) on the ΥΑΣΠΕ, the authority's copy, checked 24 October 2026
- KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026
Organise the ΥΑΣΠΕ's work in Vardion
The appointment, the policies, the ΕΑΚ assessments and the deadlines, on sample data.