# NTT Data Italia S.P.A: Insufficient fulfilment of data breach notification obligations

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2024-02-08
- Original: https://www.enforcementtracker.com/ETid-2242
- Canonical: https://overview.legal/posts/48357
- Topics: Notification Obligation, Data Breaches, Notified Body Reporting and Notification Obligations, Article 19 GDPR - Notification of Rectification, Erasure or Restriction, Controllers, Processing Agreement, Supervisory Authorities, Processing, Access Controls, Data Controller

## Summary

The Italian DPA has imposed a fine of EUR 800,000 on NTT Data Italia S.P.A. The fine is related to the fine imposed on UniCredit (ETid-2227). UniCredit had contracted NTT to carry out vulnerability analyses and penetration tests. During its investigation, the DPA found that NTT had not notified UniCredit of a data breach in a timely manner. In addition, NTT had contracted another company to carry out vulnerability assessments and penetration tests without prior authorization from the bank as the

## Full text

The Italian DPA has imposed a fine of EUR 800,000 on NTT Data Italia S.P.A. The fine is related to the fine imposed on UniCredit (ETid-2227). UniCredit had contracted NTT to carry out vulnerability analyses and penetration tests. During its investigation, the DPA found that NTT had not notified UniCredit of a data breach in a timely manner. In addition, NTT had contracted another company to carry out vulnerability assessments and penetration tests without prior authorization from the bank as the data controller.

GDPR Articles: Art. 28 (2) GDPR, Art. 33 (2) GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/48357 · 2026-08-22