# Agenzia per l'Italia Digitale (AgID): Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-10-07
- Original: https://www.enforcementtracker.com/ETid-3347
- Canonical: https://overview.legal/posts/603862
- Topics: Public Authority, Supervisory Authorities

## Summary

The Italian Data Protection Authority (Garante) fined Agenzia per l'Italia Digitale (AgID) €15,000 for lacking a sufficient legal basis for personal data processing. The Garante found that AgID's processing operations violated GDPR Articles 5(1)(a) and (c), as well as Article 6(1)(c) and (e), by failing to satisfy the lawfulness, fairness, and purpose-limitation principles. The enforcement action arose in the public sector context and resulted in a monetary sanction imposed on October 7, 2026.

## Full text

Italian Data Protection Authority (Garante) fined Agenzia per l'Italia Digitale (AgID) €15,000 on 2026-10-07 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR
Sector: Public Sector and Education
Country: Italy
Source: https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10309202

---
Generated by overview.legal · https://overview.legal/posts/603862 · 2026-10-24