HDPA Greece: AFM and AMKA Detection
Updated for 2026
Greece's data protection authority (HDPA) issued 89 enforcement decisions in 2024. That is a 162% rise from 34 decisions in 2022. Tourism drives 38% of HDPA cases. Maritime operations add further risk.
See the GDPR compliance guide for context on national DPA enforcement.
AFM: Tax Registration Number
The ΑΦΜ is a 9-digit tax number. Every citizen, resident, and business holds one.
Checksum: Multiply digits 1–8 by weights 256, 128, 64, 32, 16, 8, 4, and 2. Sum the products. Take modulo 11. If the result is 10, the number is not valid. Otherwise, the check digit is the result modulo 10.
The AFM appears on invoices, contracts, and government forms. It is the primary ID for both people and businesses in the country.
Detection gap: Generic NLP tools find the AFM with only 52% accuracy (HDPA 2024). Three causes explain this. First: the 9-digit format looks like many reference numbers and date parts. Second: the two-step modulo checksum is missing from most generic tools. Third: the number often has no label — it sits inside an address block.
For more on structured IDs, see the entities reference.
AMKA: Social Insurance Number
The ΑΜΚΑ is an 11-digit number. Digits 1–6 encode the birth date in DDMMYY format. Digit 7 encodes gender: odd for male, even for female. Digits 8–11 form the serial number and check digit.
This design is similar to Sweden's personnummer. Both raise the same GDPR concern. The number reveals biological sex as a data point.
The AMKA appears in health records, social security files, and payroll. Every citizen and resident holds one. It acts as the main number for health care and benefits. See the security and compliance page for how GDPR applies to this data type.
Script Support Gap
Hellenic text uses a different script from Latin languages. This is a core challenge for PII tools.
Unicode ranges: Hellenic characters sit in U+0370–U+03FF and U+1F00–U+1FFF. Tools built only for ASCII or Latin scripts will not process these characters.
NER model: spaCy's el_core_news model handles Hellenic NER. But it needs explicit setup. Most default pipelines use English only. They produce no output on Hellenic-script documents.
Mixed-script files: Documents in the country often mix Hellenic and Latin script. Brand names and technical terms appear in Latin. Body text is in Hellenic. A pipeline must handle both.
Case forms: Names shift form in Hellenic sentences. Γεώργιος Παπαδόπουλος in subject form becomes Γεωργίου Παπαδόπουλου in genitive. A tool needs morphological analysis to catch both.
See the FAQ for questions about multilingual PII detection.
Tourism Compliance Risks
Tourism drives 38% of HDPA cases. Scale and seasonality create the main risks.
PMS retention: Hotel systems collect passport numbers, birth dates, and contact data. HDPA found many systems keep this data for five or more years. Most had no stated purpose. Most had weak security controls.
Payment data: Hotels process card data from local and foreign guests. Folios hold partial card numbers. Booking systems hold full card details. Both PCI DSS and GDPR apply.
Seasonal staff: Hospitality staff often work 4–6 month contracts. HDPA found many cases where access was not removed when staff left. This gap is common in high-turnover sectors.
Technical Checklist for HDPA Compliance
For processing documents in the Hellenic language, use this minimum stack. AFM detection needs two-step modulo checksum validation. AMKA detection needs birth-date and gender-digit parsing. Add Hellenic-script NER via spaCy el_core_news. Include passport and national ID detection in both scripts.
For tourism operators, two organizational steps are also needed. First: document PMS data retention periods. Second: remove system access when seasonal staff leave. These steps address the most common HDPA findings.
See pricing for API plans that fit document-heavy hospitality workflows.
anonym.legal detects AFM and AMKA with full checksum validation. It supports Hellenic-script NER via the spaCy el_core_news pipeline.
When This Approach Has Limits
Two-step modulo checksum validation for the AFM, birth-date and gender-digit parsing for the AMKA, and Hellenic-script NER form the right baseline — that part of the approach is sound. But limits remain worth stating plainly.
The AFM and AMKA formats and Hellenic text need configuration and held-out testing. Generic tools find the AFM at only 52 percent accuracy because its 9-digit form mimics reference numbers, its two-step modulo-11 check is usually absent, and it often appears unlabelled inside an address block. Hellenic script sits in Unicode ranges that ASCII-only pipelines never process, and names shift form from nominative to genitive across a sentence. Each of these has to be configured and then measured on held-out Greek documents; default English pipelines produce no output at all on Hellenic-script files.
Detection accuracy bounds the result. Masking an AFM or AMKA only helps if it was found, and an unlabelled number buried in mixed Hellenic and Latin text is exactly the case generic tools miss. The residual false-negative rate sets the ceiling on coverage, and morphological case variation means a name caught in one form can slip through in another. Verify recall against your real tourism and maritime documents, not against clean samples, before relying on the output.
Custody and access control are not detection quality. HDPA's tourism findings turned on PMS systems retaining passport numbers for years with no stated purpose and on access left active after seasonal staff departed. Those are organizational and lifecycle failures that no detector addresses; documenting retention and revoking access are separate controls. Accurate AFM and AMKA detection is one technical measure, but the authority audits retention, access, and human review together, and the controller owns that whole posture.