In the DYPA New Freelancer Program (former OAED). Whether it's the classic €14,800 NEE scheme or the €17,000 Digital Economy program. The audit DYPA inspectors perform on your e-shop is not about having a pretty template. It's about specific technical, functional and legal criteria that are strictly verified, usually with an on-site audit.
If these criteria aren't met, your subsidy may not be approved. Or worse, it can be clawed back if it has already been disbursed. This guide breaks down every audit category, what they actually require, and how to prepare.
The four DYPA audit categories
The audit is split into four pillars. For your subsidy to be approved, your e-shop must cover all four. Not 3 out of 4.
- Accessibility (WCAG 2.1 Level AA)
- Functional e-shop spec (payments, checkout, responsive, SSL)
- Legal framework (GDPR, terms, right of withdrawal, cookies)
- Publicity for ESPA / NextGenerationEU (logos and funding statements)
1Accessibility (WCAG 2.1 AA). The critical pillar
Compliance with WCAG 2.1 Level AA is mandatory across all co-funded programs in Greece (ESPA, DYPA, RRF). It's also where most businesses fail, because off-the-shelf templates aren't compliant out of the box.
What auditors actually check
- Semantic HTML and correct heading hierarchy. One H1 per page, then H2 → H3 without skipping levels.
- Alt text on every image. Decorative images get
alt="", meaningful ones get a description. - Keyboard navigation. Tab, Shift+Tab, Enter, Esc, with a visible focus state.
- Screen reader compatibility. ARIA labels on buttons, forms, drawers.
- Contrast ratio ≥ 4.5:1 for normal text and ≥ 3:1 for large text.
- Accessibility toolbar. While not strictly required by WCAG itself, DYPA auditors systematically ask for it (contrast toggles, font-size scaling, dyslexic font).
The deliverable they will ask for
A WCAG 2.1 AA Compliance Statement signed by the builder. It comes with a Lighthouse report (score > 90), a WAVE report (no critical errors) and a manual testing report.
Watch out for the "Lighthouse 90% = compliant" myth. Lighthouse covers about 25% of WCAG rules. The rest requires manual checking.
2Functional e-shop spec
The store must be 100% functional and ready for real transactions on audit day. Not sitting in "under construction" mode.
- Payment gateway connected to a recognised bank or provider (Viva Wallet, Cardlink, Stripe, Alpha, Eurobank). Prefer redirect / hosted checkout over iframe. Since PSD2, iframe doesn't always pass SCA.
- Active SSL on every page, not just the checkout.
- Full purchase flow: add to cart → details → shipping cost → delivery method → receipt or invoice → payment → confirmation.
- Shipping and courier with pricing, ideally with tracking.
- Product catalog with real products of your business, prices, VAT, descriptions and stock. No Lorem Ipsum, no demo content.
- Responsive design on mobile, tablet and desktop.
3Legal framework and GDPR
Inspectors always check the footer and the mandatory legal pages.
Business details in the footer
- Legal name and trade name
- VAT, Tax Office (DOY), GEMI number (mandatory)
- Registered address
- Phone and email
Mandatory pages
- Terms of use and transactions. Detailed, not a generic template.
- 14-day right of withdrawal (Greek Law 2251/1994, article 3e).
- Returns and cancellations policy.
- Privacy policy (GDPR). What data, why, how long.
Cookie banner
Opt-in before activating any tracking script (Google Analytics, Meta Pixel, etc.) with:
- Cookie categorisation (necessary, statistics, marketing).
- Ability to withdraw consent.
- Consent log with timestamp.
Generic "Accept All" banners without choice do not pass. They are non-compliant with the Greek Data Protection Authority's guidance.
4Publicity for ESPA / NextGenerationEU
Any digital asset funded by the program must carry the publicity marks in a prominent location.
Logos depend on your specific call:
- DYPA NEE €14,800 → ESPA + ESF+ + European Union + Ministry of Labour logos. No "Greece 2.0" branding here.
- Digital Economy €17,000 / RRF → NextGenerationEU + "Greece 2.0" + EU + DYPA logos.
A common mistake is slapping "Greece 2.0 / NextGenerationEU" branding on an ESPA program, or vice versa. Always download your specific call's Publicity Annex from dypa.gov.gr or espa.gr and copy exactly what it states.
The most common pitfalls
From experience, these are the 3 mistakes that cost businesses their audit:
- "Ready-made template" with no accessibility work. The premium theme you bought on ThemeForest is not WCAG AA by itself.
- Wrong publicity logos. ESPA and RRF have different sets. Mixing them = finding.
- Opt-out cookie banner instead of opt-in. Violates GDPR and the Greek DPA's guidance.
How much does a properly compliant e-shop cost
Cost depends on product count, integrations and customisation level. Indicative figures:
- Small e-shop (up to 50 products, 1 payment gateway): €800 – €1,500 + VAT.
- Medium e-shop (up to 200 products, ERP integration): €1,800 – €3,500 + VAT.
- Custom Laravel with advanced features: €3,500 – €8,000 + VAT.
Quotes must include the compliance certificate, GDPR stack and at least 30 days of support.
Audit-day checklist
The day before your audit, run through this quick list:
- Lighthouse accessibility score > 90.
- WAVE: 0 errors.
- Keyboard-only test: can you complete a purchase without a mouse?
- SSL active on every page (not just checkout).
- Cookie banner: no tracking scripts fire before acceptance.
- Footer: VAT, Tax Office and GEMI numbers visible and correct.
- 14-day withdrawal: written in plain language.
- Publicity logos: exactly those stated in your call.
A ready-made DYPA package
If you don't want to chase all of the above one by one, we've built a ready package specifically for new freelancers in the program: €800 + VAT with WCAG 2.1 AA, GDPR, a compliance certificate, 1-year hosting, a PDF training guide and a 30-minute live training session (product import, images, order handling). A domain is optional, if you don't already have one. Delivered in 10–14 business days.
