# Barbuti S.p.A.: Insufficient fulfilment of data subjects rights

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-09-23
- Original: https://www.enforcementtracker.com/ETid-3398
- Canonical: https://overview.legal/posts/607208
- Topics: Personal Data, Right to be Forgotten, Accountability, Transparency, Supervision, Processing, Supervisory Authorities

## Summary

The Italian Data Protection Authority (Garante) fined Barbuti S.p.A. €5,000 for insufficient fulfillment of data subjects' rights, specifically finding violations of GDPR Articles 5(2), 12, and 17. The enforcement action addressed the company's failure to properly handle data erasure requests and its non-compliance with general accountability and transparency obligations governing the processing of personal data.

## Full text

Italian Data Protection Authority (Garante) fined Barbuti S.p.A. €5,000 on 2026-09-23 for: Insufficient fulfilment of data subjects rights.
GDPR Articles: Art. 5 (2) GDPR, Art. 12 GDPR, Art. 17 GDPR
Sector: Industry and Commerce
Country: Italy
Source: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10312650

## Cited law provisions (4)

### GDPR — gdpr-art-5-par-2-en

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-12-en

Transparent information, communication and modalities for the exercise of the rights of the data subject

### GDPR — gdpr-art-17-en

Right to erasure (‘right to be forgotten’)

---
Generated by overview.legal · https://overview.legal/posts/607208 · 2026-11-14