Content type · 697 documents in this view · 3,811 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Country: Italy (50) Clear filter
Filter by Topic Supervisory Authorities 3587 Processing 2635 Personal Data 2394 Controllers 2017 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
51–100 of 697 sort newestlargest fineoldest
€6,600 Cosmint S.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Cosmint S.p.A. €6,600 for violating general data processing principles in the employment sector, specifically under Articles… Italy ·Garante ·Art. 5, 6, 13 Retention Period Supervision Supervisory Authorities Jun 18, 2026
€460,000 Garante · 476/2026 Two former employees (the data subjects) of Piaggio (the controller) were dismissed for just cause in March 2023. Following the termination of their employment, they asked the… Italy ·Art. 5, 6, 12 +2 Retention Period Storage Limitation Personal Data Jun 18, 2026
€6,600 Garante · 462/2026 The case involves a worker (the data subject), his former employer (the controller), and the staffing agency that had provided the company with the worker. In late 2023 the data… Italy ·Art. 2, 4, 5 +2 Legitimate Interest Personal Data Integrity and Confidentiality Principle Jun 18, 2026
€10,000 Docplanner Italy S.r.l.: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined Docplanner Italy S.r.l. €10,000 for failing to implement sufficient technical and organizational measures to ensure… Garante ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Security Personal Data Supervision Jun 18, 2026
€5,000 Garante · 457/2026 The Municipality of Vasto (the controller) implemented a dedicated photo and video system for the purpose of detecting violations of the national provisions on traffic safety. A… Italy ·Art. 5, 6, 12 +2 DPIA Personal Data Fairness & Transparency Jun 18, 2026
€2,075 Edizioni Grandangolo di Giuseppe Castaldo: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Edizioni Grandangolo di Giuseppe Castaldo €2,075 for failing to comply with general data processing principles under Articles… Italy ·Garante ·Art. 5, 12, 13 +4 Notification Obligation Data Breaches Controllers Jun 18, 2026
€4,500 Lecce Local Health Authority: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the Lecce Local Health Authority €4,500 for failing to implement adequate technical and organizational measures to ensure… Italy ·Garante ·Art. 5, 29, 32 Security Supervision Supervisory Authorities Jun 11, 2026
€15,300 Green Partner S.r.l.s.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Green Partner S.r.l.s. €15,300 for violations of multiple GDPR provisions, including Articles 5, 6, 7, 12, 15–22, and 28,… Italy ·Garante ·Art. 5, 6, 7 +3 Controllers Processors Supervision Jun 11, 2026
€1,000 Pietro d'Abano State Vocational School: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined Pietro d'Abano State Vocational School €1,000 for processing personal data without a sufficient legal basis, finding… Italy ·Garante ·Art. 5, 6 Personal Data Processing Public Authority Jun 11, 2026
€5,000 Municipality of Vasto: Insufficient fulfilment of information obligations The Italian Data Protection Authority (Garante) fined the Municipality of Vasto €5,000 for failing to adequately fulfill its information obligations under the GDPR. The authority… Italy ·Garante ·Art. 5, 12, 13 +1 Accountability Personal Data DPIA Jun 8, 2026
€700 Italian Red Cross: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined the Italian Red Cross €700 for violating general data processing principles under GDPR Articles 5(1)(c), 5(1)(f), and 9. The… Italy ·Garante ·Art. 5, 9 Integrity and Confidentiality Principle Retention Period Professional Secrecy May 28, 2026
€1,400 Ristorante Carlo Menta s.r.l.: Insufficient fulfilment of information obligations The Italian Data Protection Authority (Garante) fined Ristorante Carlo Menta s.r.l. €1,400 for failing to adequately fulfill its information obligations under the GDPR. The… Italy ·Garante ·Art. 5, 13 Personal Data Transparency Supervisory Authorities May 28, 2026
€3,930 Action Fit di Milano: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Action Fit di Milano €3,930 for violations of Articles 6(1)(a), 12, and 21(2) GDPR, relating to non-compliance with general… Italy ·Garante ·Art. 6, 12, 21 Right to Object Supervision Personal Data May 28, 2026
€6,000 Municipality of Sciacca: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Municipality of Sciacca €6,000 for processing personal data without a sufficient legal basis. The Garante found that the… Italy ·Garante ·Art. 5, 6 Personal Data Public Authority Supervisory Authorities May 28, 2026
€55,000 The data controller for the case is a government body called the Agency for Digital Italy (AgID) AgID is tasked with driving the adoption of digital technologies in both government and the private sector. Additionally, AgID is Italy’s soon-to-be notification authority for the… 419/2026 ·Garante ·Art. 5, 12, 14 +1 Personal Data Controllers Processing May 28, 2026
€6,000 Liguria Health Protection Authority: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Liguria Health Protection Authority €6,000 for lacking a sufficient legal basis for personal data processing in the… Italy ·Garante ·Art. 5, 6, 25 +2 Controllers Retention Period Processing May 28, 2026
€700 Rosetta Trastervere s.r.l.s.: Insufficient fulfilment of information obligations The Italian Data Protection Authority (Garante) fined Rosetta Trastervere s.r.l.s. €700 for failing to adequately fulfill its information obligations under the GDPR. The authority… Italy ·Garante ·Art. 5, 13 Supervisory Authorities May 28, 2026
€6,000 A data subject filed a complaint before the DPA against the Liguria Health Protection Agency (the controller) The data subject was employed by the Ligurian Social and Health Care Agency, however, the organisation was later merged with the controller. According to the data subject, the… 382/2026 ·Italy ·Garante Privacy by Design Privacy by Design & Default DPIA May 28, 2026
€700 Garante · 385/2026 A data subject brought a complaint to the DPA through a non-profit organisation (LILA) against the Italian Red Cross (the controller). While the data subject was hospitalised,… Italy ·Art. 5, 9 Personal Data Retention Period Integrity and Confidentiality Principle May 28, 2026
€3,000 Autonomous Region of Sardinia: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Autonomous Region of Sardinia €3,000 on May 28, 2026, for processing personal data without a sufficient legal basis. The… Italy ·Garante ·Art. 5, 6 Personal Data Public Authority Supervisory Authorities May 28, 2026
€180,000 Emirates: Insufficient fulfilment of information obligations The Italian Data Protection Authority (Garante) fined Emirates €180,000 for insufficient fulfillment of its information obligations under the GDPR. The authority found that the… Italy ·Garante ·Art. 5, 12, 13 Personal Data Supervisory Authorities May 14, 2026
€30,000 Vortika s.r.l.: Insufficient fulfilment of information obligations The Italian Data Protection Authority (Garante) fined Vortika s.r.l. €30,000 for failing to adequately fulfill its information obligations under the GDPR in the health care… Italy ·Garante ·Art. 5, 13, 14 +1 Transparency Supervisory Authorities May 14, 2026
€43,000 Lidl Italia S.r.l.: Insufficient fulfilment of data subjects rights The Italian Data Protection Authority (Garante) fined Lidl Italia S.r.l. €43,000 for insufficient fulfillment of data subjects' rights under Articles 5, 12, 15, and 18 of the… Italy ·Garante ·Art. 5, 12, 15 +1 Supervisory Authorities Transparency May 14, 2026
€8,000 Municipality of Ventasso: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined the Municipality of Ventasso €8,000 for violating the general data processing principles under Articles 5, 6, and 9 of the… Italy ·Garante ·Art. 5, 6, 9 Types of Special Categories of Personal Data Personal Data Public Authority May 14, 2026
€1,000 FeGi M&A Services s.r.l.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined FeGi M&A Services s.r.l. €1,000 for non-compliance with general data processing principles under Article 5(1)(a) and Article… Italy ·Garante ·Art. 5, 14 Supervision Supervisory Authorities Personal Data May 14, 2026
€1,500 Francesco Gagliardi: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) found Francesco Gagliardi, operating as a sole proprietorship, in violation of Articles 5(1)(a) and 14 of the GDPR and Article 130… Italy ·Garante ·Art. 5, 14 Legitimate Interest Personal Data Lawful Basis May 14, 2026
€1,000 Danta di Cadore Hunting Reserve: Insufficient fulfilment of information obligations The Italian Data Protection Authority (Garante) fined the Danta di Cadore Hunting Reserve €1,000 for failing to adequately fulfill its information obligations regarding the… Italy ·Garante ·Art. 5, 6, 13 Personal Data Processing Supervisory Authorities May 14, 2026
€15,000 Monaldi-Cotugno-CTO: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined the Monaldi-Cotugno-CTO hospital entity €15,000 for violating general data processing principles under the GDPR. The… Italy ·Garante ·Art. 5, 9, 13 +2 Healthcare Types of Special Categories of Personal Data Security May 14, 2026
€1,800 Municipality of Mirabella Imbaccari: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Municipality of Mirabella Imbaccari €1,800 for processing personal data without a sufficient legal basis, in violation of… Italy ·Garante ·Art. 5, 6, 37 Public Authority Supervisory Authorities Supervision May 14, 2026
€100,000 Energia Sostenibile S.r.l.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Energia Sostenibile S.r.l. €100,000 for violations of multiple GDPR provisions, including Articles 5, 6, 7, 12, 13, 15, 24,… Italy ·Garante ·Art. 5, 6, 7 +5 Controllers Processors Supervision May 14, 2026
€8,600 Matera Local Health Authority: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the Matera Local Health Authority €8,600 for failing to implement sufficient technical and organizational measures to ensure… Italy ·Garante ·Art. 5, 32 Security Personal Data Supervision Apr 29, 2026
€34,000 Pianeta S.r.l.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Pianeta S.r.l. €34,000 for violations of multiple GDPR provisions, including Article 5(1)(a) and (b) on general data… Italy ·Garante ·Art. 5, 6, 12 +5 Personal Data Processing Transparency Apr 29, 2026
€100,000 Lepida S.c.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Lepida S.c.p.A. €100,000 for violating general data processing principles under the GDPR. The enforcement action addressed… Italy ·Garante ·Art. 5, 13, 25 +1 Retention Period Storage Limitation Security Apr 29, 2026
€15,000 Nouva Corrente S.r.l.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Nouva Corrente S.r.l. €15,000 for non-compliance with general data processing principles under the GDPR. The enforcement… Italy ·Garante ·Art. 1, 2, 5 +3 Personal Data Supervision Consent Apr 29, 2026
€12,000 Ministry of Justice: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Ministry of Justice €12,000 for insufficient legal basis for personal data processing. The enforcement action, decided on… Italy ·Garante ·Art. 5, 6, 9 Fairness & Transparency Personal Data Healthcare Apr 29, 2026
€4,000 Montelibretti State Comprehensive School: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined Montelibretti State Comprehensive School €4,000 for lacking a sufficient legal basis for its data processing activities. The… Italy ·Garante ·Art. 5, 6, 9 Personal Data Healthcare Processing Apr 29, 2026
€5,000 Dr. Guzzo: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined Dr. Guzzo €5,000 for processing personal data without a sufficient legal basis. The violation concerned healthcare data and… Italy ·Garante ·Art. 5, 9 Retention Period Controllers Healthcare Apr 29, 2026
€2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-04-17 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 32 Processing Supervisory Authorities Apr 17, 2026
€6.6M Poste Italiane S.p.a.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Poste Italiane S.p.a. €6,624,000 on 2026-04-17 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 13 +4 Supervisory Authorities Processing IP Address Apr 17, 2026
€6,000 Comune di Campo Calabro: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Campo Calabro €6,000 on 2026-04-17 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Employees Supervisory Authorities Apr 17, 2026
€5,000 Framos Italia s.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Framos Italia s.r.l. €5,000 on 2026-04-17 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 12 +3 Processing Supervisory Authorities Employees Apr 17, 2026
€2,000 Io e te s.r.l.s.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Io e te s.r.l.s. €2,000 on 2026-04-17 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Supervisory Authorities Processing Apr 17, 2026
€5.9M Postepay S.p.a.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Postepay S.p.a. €5,877,000 on 2026-04-17 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 13 +4 Supervisory Authorities Processing IP Address Apr 17, 2026
€2,000 Physician: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Physician €2,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 13 Personal Data Supervisory Authorities Healthcare Mar 26, 2026
€96,000 Eni S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Eni S.p.A. €96,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Supervisory Authorities Mar 26, 2026
€2,500 Comune di Cassino: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Cassino €2,500 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Education Public Authority Mar 26, 2026
€5,000 Esselunga S.p.A.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Esselunga S.p.A. €5,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 12, 15 Personal Data Supervisory Authorities Employees Mar 26, 2026
€1,000 Euro Bangla Minimarket in Jesi: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Euro Bangla Minimarket in Jesi €1,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 88 Processing Employees Supervisory Authorities Mar 26, 2026
€2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Supervisory Authorities Processing Mar 26, 2026
€2,000 Copacabana s.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Copacabana s.r.l. €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Supervisory Authorities Processing Healthcare Mar 26, 2026