Liability for theft: the client or the security company?

Guarding reduces risk; it is not property insurance. After a theft, three questions decide who bears the loss:

1. What had the company undertaken? A static post at the gate, patrols every two hours, or alarm response are different obligations.
2. Did it do it? Did the guard pass the checkpoints, record what they saw, raise the alarm as the instructions required?
3. Did the client contribute? A door left open against the instructions or an alarm out of service count too.

This guide describes what the Greek Civil Code articles say, not how a particular case will be decided. For an actual theft, get legal advice.

• [Art. 330](https://www.lawspot.gr/nomothesia/astikos-kodikas/arthro-330-astikos-kodikas-eythyni-logo-ptaismatos/): unless otherwise agreed, the debtor is liable for every breach of its obligation through intent or negligence. Negligence means failing to exercise the care required in dealings.
• [Art. 334](https://www.lawspot.gr/nomothesia/astikos-kodikas/arthro-334-astikos-kodikas-eythyni-apo-ptaisma-toy/): the debtor is liable for the fault of the people it uses to perform as for its own fault. For a security company, those people are the guards it sends.
• [Art. 914](https://www.lawspot.gr/nomothesia/astikos-kodikas/arthro-914-astikos-kodikas-ennoia/): whoever harms another unlawfully and culpably must compensate them. The first person at fault in a theft is the thief.
• [Art. 922](https://www.lawspot.gr/nomothesia/astikos-kodikas/arthro-922-astikos-kodikas-eythyni-toy-prostisantos/): whoever puts someone into a service is liable for damage that person caused to a third party unlawfully in the course of that service — relevant when the guard is the one who causes the damage.

The key words are “its obligation”. The law does not define what a guard must do on every site; the contract does. That is why the same theft can end differently on two sites with different contracts.

• Scope: which posts, which hours, which areas — is the back storeroom covered or not?
• Post orders: patrol frequency, checkpoints, lock and alarm checks, whom the guard calls. See the guide to post orders.
• Reporting: what is recorded each shift and how you are told about an incident.
• Liability limits and insurance: how far the company is liable and under which policy — see the guarding contract terms.

A limitation-of-liability clause has limits of its own. Article 332 makes void any advance agreement that excludes or limits liability for intent or gross negligence, and in some cases even for slight negligence — for instance when the clause sits in a term that was not individually negotiated. Art. 334 allows liability for auxiliaries to be limited only outside those cases. Whether a clause in your contract holds is for your lawyer to judge.

• Patrols: which checkpoints were scanned and when — showing whether the guard passed the spot of the theft and how long before.
• Shift report: what was taken over, observed and handed over.
• Incident report: facts with exact times, actions, who was alerted. How to write one that holds up: see the guide to the incident report.
• Cameras: the Hellenic DPA’s Directive 1/2011 allows footage of an incident to be kept up to 30 days when it concerns the controller and up to 3 months when it concerns a third party (art. 8). Isolate it in time.

This evidence protects both sides: the client if the guarding was not done as agreed, the company if it was. At OVIT, patrols, incidents and reports are recorded in Guardly, and the client sees them in the same live picture as the operations team.

Article 300 also applies when the injured party failed to avert or limit the damage, or did not warn the debtor of a risk of unusually large damage the debtor neither knew nor ought to have known about. For a client, in practice:

• Tell the security company in writing when goods or equipment of unusual value are on site, and ask for the post orders to change accordingly.
• Keep working whatever the instructions rely on: locks, lighting, alarm, cameras.
• Do not bypass the instructions: a supplier let in without being logged “because we know him” is a gap.

1. Written notice to the security company, with date, time and what is missing.
2. Preserve evidence: patrols, shift and incident reports, camera footage within the Directive 1/2011 periods.
3. Police: the theft report, and a record of what was handed over, to whom and when.
4. Insurance: your own insurer — and ask the security company to notify its insurer. What to check in its policy: see the guide to security company liability insurance.
5. Lawyer: before accepting or rejecting liability, in writing or verbally.

Then close the gap: does the patrol route, the post orders or the equipment need to change? If you want a guarding proposal with written instructions and reports that prove what happened on every shift, get in touch.