Content type · 616 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Country: Italy (50) Clear filter
Filter by Topic Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
Italy · €20,000 Garante per la protezione dei dati personali (Italy) - 471/2026 Facts — The provincial Health Authority of Enna (the controller) published a resolution that contained the personal data of a data subject (specifically related to their judicial… Personal Data Fairness & Transparency Retention Period Jul 18, 2026
Italy · €50,000 Garante per la protezione dei dati personali (Italy) - 10128005 Facts — The Calabrian Regional Agency for Agricultural Development (the controller) implemented a remote work policy that required employees to use a time-tracking application… DPIA Monitoring Privacy Impact Assessment Jul 16, 2026
Italy · €16,000 Garante per la protezione dei dati personali (Italy) - 10192784 Facts — The data subject, a professional registered with the OPI of Pisa, discovered while consulting the Public Register of Professionals online that the database included the… Personal Data Processing Retention Period Jul 16, 2026
Italy · €158,000 Garante per la protezione dei dati personali (Italy) - 487/2026 Facts — Character Technologies, Inc (the controller) is a company established in the US that operates the site Character.AI. Character.AI is a generative AI service that allows… DPIA Processing Artificial Intelligence Jul 3, 2026
Italy · €55,000 Garante per la protezione dei dati personali (Italy) - 419/2026 Facts — The data controller for the case is a government body called the Agency for Digital Italy (AgID). AgID is tasked with driving the adoption of digital technologies in both… Controllers Processing Personal Data May 28, 2026
Italy · €6,000 Garante per la protezione dei dati personali (Italy) - 382/2026 Facts — A data subject filed a complaint before the DPA against the Liguria Health Protection Agency (the controller). The data subject was employed by the Ligurian Social and… DPIA Privacy by Design Privacy by Default May 28, 2026
Italy · €700 Garante per la protezione dei dati personali (Italy) - 385/2026 Facts — A data subject brought a complaint to the DPA through a non-profit organisation (LILA) against the Italian Red Cross (the controller). While the data subject was… Personal Data Healthcare Retention Period May 28, 2026
Garante · €5,000 Framos Italia s.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Framos Italia s.r.l. €5,000 on 2026-04-17 for: Non-compliance with general data processing principles. Employees IP Address Processing Apr 17, 2026
Garante · €2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-04-17 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Apr 17, 2026
Garante · €5,877,000 Postepay S.p.a.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Postepay S.p.a. €5,877,000 on 2026-04-17 for: Non-compliance with general data processing principles. IP Address Insurance Processing Apr 17, 2026
Garante · €6,000 Comune di Campo Calabro: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Campo Calabro €6,000 on 2026-04-17 for: Insufficient legal basis for data processing. Employees Processing Supervisory Authorities Apr 17, 2026
Garante · €2,000 Io e te s.r.l.s.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Io e te s.r.l.s. €2,000 on 2026-04-17 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Apr 17, 2026
Garante · €6,624,000 Poste Italiane S.p.a.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Poste Italiane S.p.a. €6,624,000 on 2026-04-17 for: Non-compliance with general data processing principles. IP Address Processing Insurance Apr 17, 2026
Garante · €96,000 Eni S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Eni S.p.A. €96,000 on 2026-03-26 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Mar 26, 2026
Garante · €5,000 Esselunga S.p.A.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Esselunga S.p.A. €5,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Personal Data Employees Supervisory Authorities Mar 26, 2026
Garante · €2,000 Physician: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Physician €2,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Personal Data Healthcare Supervisory Authorities Mar 26, 2026
Garante · €2,000 Copacabana s.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Copacabana s.r.l. €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Healthcare Mar 26, 2026
Garante · €1,000 Euro Bangla Minimarket in Jesi: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Euro Bangla Minimarket in Jesi €1,000 on 2026-03-26 for: Insufficient legal basis for data processing. Employees Processing Supervisory Authorities Mar 26, 2026
Garante · €3,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Employees Public Authority IP Address Mar 26, 2026
Garante · €5,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €5,000 on 2026-03-26 for: Insufficient legal basis for data processing. Processing Public Authority Employees Mar 26, 2026
Garante · €2,500 Comune di Cassino: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Cassino €2,500 on 2026-03-26 for: Insufficient legal basis for data processing. Education Public Authority Processing Mar 26, 2026
Garante · €31,800,000 Intesa Sanpaolo S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Intesa Sanpaolo S.p.A. €31,800,000 on 2026-03-26 for: Insufficient technical and organisational measures to ensure information… Security Insurance Supervisory Authorities Mar 26, 2026
Garante · €3,000 Piacenza Bar Association: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Piacenza Bar Association €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Education Public Authority Processing Mar 26, 2026
Garante · €2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Mar 26, 2026
Garante · €40,000 INPS – Istituto nazionale previdenza sociale: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined INPS – Istituto nazionale previdenza sociale €40,000 on 2026-03-12 for: Insufficient technical and organisational measures to… Security Public Authority Public Sector Mar 12, 2026
Garante · €563,052 Enel Energia S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Enel Energia S.p.A. €563,052 on 2026-03-12 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Mar 12, 2026
Garante · €800 Barber Shop: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Barber Shop €800 on 2026-03-12 for: Insufficient fulfilment of information obligations. Corrective Actions and Duty of Information Framework Supervisory Authorities Mar 12, 2026
Garante · €2,000 Comune di Sutri: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Sutri €2,000 on 2026-03-12 for: Insufficient legal basis for data processing. Education Processing Public Authority Mar 12, 2026
Garante · €2,000 Liceo Scientifico Morgagni di Roma: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Liceo Scientifico Morgagni di Roma €2,000 on 2026-03-12 for: Insufficient technical and organisational measures to ensure… Security Education Public Authority Mar 12, 2026
Garante · €50,000 ITAS Mutua: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined ITAS Mutua €50,000 on 2026-03-12 for: Insufficient fulfilment of data subjects rights. Personal Data Supervisory Authorities Employees Mar 12, 2026
Garante · €2,000 Hanako s.r.l.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Hanako s.r.l. €2,000 on 2026-03-12 for: Insufficient technical and organisational measures to ensure information security. Security Healthcare Supervisory Authorities Mar 12, 2026
Garante · €40,000 La7 S.p.A.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined La7 S.p.A. €40,000 on 2026-03-12 for: Non-compliance with general data processing principles. IP Address Telecommunications Processing Mar 12, 2026
Garante · €15,000 Ministero delle Imprese e del Made in Italy: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Public Authority Education Public Sector Feb 26, 2026
Garante · €3,000 Groupharma s.r.l.s.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Groupharma s.r.l.s. €3,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Personal Data Employees Telecommunications Feb 26, 2026
Garante · €15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Processing IP Address Telecommunications Feb 26, 2026
Garante · €2,000 Istituto Tecnico Statale “Luigi Einaudi” di Correggio: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Istituto Tecnico Statale “Luigi Einaudi” di Correggio €2,000 on 2026-02-26 for: Insufficient legal basis for data processing. Employees Processing Telecommunications Feb 26, 2026
Garante · €15,000 Depac Società Cooperativa Sociale a r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depac Società Cooperativa Sociale a r.l. €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Employees Processing Telecommunications Feb 26, 2026
Garante · €1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Supervision Supervisory Authorities Telecommunications Feb 26, 2026
Garante · €15,000 Ministero delle Imprese e del Made in Italy: Insufficient data processing agreement Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. Processing Agreement Education Public Sector Feb 26, 2026
Garante · €32,000 Dedalus Italia S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Dedalus Italia S.p.A. €32,000 on 2026-02-26 for: Insufficient technical and organisational measures to ensure information… Security Telecommunications Supervisory Authorities Feb 26, 2026
Garante · €5,000 Conservatory: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Conservatory €5,000 on 2026-02-26 for: Insufficient legal basis for data processing. Education Public Authority Processing Feb 26, 2026
Garante · €12,000 Ministero dell’Economia e delle Finanze: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero dell’Economia e delle Finanze €12,000 on 2026-02-26 for: Insufficient legal basis for data processing. Public Authority Education Public Sector Feb 26, 2026
Garante · €10,000 Radio Immagine Uno S.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Radio Immagine Uno S.r.l. €10,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Personal Data Telecommunications Supervisory Authorities Feb 26, 2026
Garante · €30,000 S.M. Trattamento Acqua di XX: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined S.M. Trattamento Acqua di XX €30,000 on 2026-02-26 for: Insufficient legal basis for data processing. Telecommunications Processing Supervisory Authorities Feb 26, 2026
Garante · €30,000 Sportitalia Società Sportiva Dilettantistica a.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Sportitalia Società Sportiva Dilettantistica a.r.l. €30,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Personal Data Telecommunications Supervisory Authorities Feb 12, 2026
Garante · €12,000 Based s.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Based s.r.l. €12,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Personal Data Employees Telecommunications Feb 12, 2026
Garante · €15,000 Lex Iuris S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Lex Iuris S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Education Public Authority Processing Feb 12, 2026
Garante · €2,000 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Processing Telecommunications Supervisory Authorities Feb 12, 2026
Garante · €2,000 Comune di Monterotondo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Monterotondo €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Public Authority Education Public Sector Feb 12, 2026
Garante · €1,500 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €1,500 on 2026-02-12 for: Insufficient legal basis for data processing. Processing Telecommunications Supervisory Authorities Feb 12, 2026