Italy's data protection authority – the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority, known as the Garante) – has significantly escalated enforcement activity in recent months. Investigations have widened in scope, fines have reached substantial levels, and the Garante has issued new guidance that directly affects how international businesses manage personal data in the Italian market. Companies that have treated GDPR compliance as a one-time exercise are now discovering that their exposure is ongoing and material.
The Garante's recent enforcement actions reflect a sustained focus on three areas: unlawful data transfers outside the European Economic Area. Defective consent mechanisms on digital platforms. Additionally, inadequate contractual arrangements between data controllers and data processors. Affected organisations must review their compliance posture without delay. Businesses that process personal data of Italian residents – regardless of where the data controller is established – fall within the Garante's reach under EU data protection legislation.
This alert explains which organisations are in scope, what the enforcement priorities are, and what immediate steps are required to reduce exposure.
What has changed: the Garante's enforcement priorities
The Garante has openly stated that its supervisory programme for the current period targets specific structural weaknesses in how organisations handle Italian residents' data. The authority has moved away from reactive complaint-driven enforcement toward proactive, sector-wide investigations.
Three enforcement themes dominate the current cycle. First, the Garante is scrutinising international data transfers. Organisations relying on standard contractual clauses must demonstrate that a genuine transfer impact assessment has been carried out. The Garante has taken the position that template clauses alone – without a documented assessment of the legal conditions in the destination country – do not satisfy EU data protection legislation. Findings of unlawful data transfer have resulted in suspension orders, not merely fines.
Second, the authority has targeted consent mechanisms on websites and applications serving Italian users. Cookie banners that default to acceptance, that use pre-ticked boxes, or that make withdrawal of consent more difficult than granting it, are being treated as invalid under applicable data protection rules. The Garante has issued formal warnings and fines to both Italian-established entities and foreign operators with no local presence.
Third, enforcement has focused on the contractual relationship between data controllers and data processors. Under EU data protection legislation, every processor must operate under a binding written agreement specifying the subject matter, duration, and nature of the processing. The Garante has found that many organisations – particularly those using cloud providers, payroll processors, and marketing platforms – have either absent or materially deficient processing agreements.
Alongside these three themes, the Garante has continued its high-profile examination of artificial intelligence systems that process personal data. Companies deploying AI-driven tools in the Italian market should be aware that the Garante treats this as a distinct enforcement priority. For a detailed assessment of AI-related data obligations in Italy, see our analysis of AI law and regulatory compliance in Italy.
Who is affected: threshold criteria and business categories
The Garante's jurisdiction is broad. Any organisation that processes personal data of individuals located in Italy – whether as a data controller or a data processor – may fall within scope. Establishment in Italy is not required. The following categories face the highest immediate exposure.
- E-commerce and digital platforms with Italian user bases, particularly those relying on behavioural advertising or third-party analytics tools.
- Financial services and fintech companies processing payment data, creditworthiness information, or transaction histories of Italian residents.
- Healthcare and wellness providers handling health data – a special category under data protection legislation – where the Garante applies heightened scrutiny.
- Human resources and employment platforms processing employee data for Italian-based staff or remote workers.
- Cloud service providers and data processors acting on behalf of Italian-established controllers.
Threshold criteria matter. The Garante applies a risk-based approach: organisations processing large volumes of sensitive data, those conducting systematic monitoring of individuals, and those transferring data to third countries outside the EEA face closer scrutiny. However, smaller organisations with defective consent banners or absent processing agreements are equally at risk of formal action. The authority has demonstrated willingness to issue fines across the full range of business sizes.
To receive an expert assessment of your organisation's data protection exposure in Italy, contact us at info@ferrazwhitmore.com.
What to do now: immediate actions for international companies
Organisations with Italian market exposure should treat the following as urgent action items, not deferred compliance projects.
Audit your data transfer mechanisms. Identify every data flow that moves personal data of Italian residents to a country outside the EEA. Confirm that an appropriate transfer tool is in place – and that a documented transfer impact assessment accompanies any reliance on standard contractual clauses. If that assessment has not been completed, it must be carried out before the next scheduled supervisory review cycle, which the Garante has indicated will continue on a rolling basis through the current year.
Review and rebuild consent mechanisms. Any cookie banner, consent form, or preference centre used on Italian-facing digital properties must be audited against the Garante's published guidance. Consent must be freely given, specific, informed, and unambiguous. The mechanism for withdrawing consent must be as easy as granting it. Non-compliant banners should be corrected within weeks, not months – the Garante has acted against operators within short timeframes after identifying deficiencies.
Verify processor agreements. Map every third-party vendor that processes personal data on your behalf. Confirm that a compliant data processing agreement is in place with each one. Agreements that were drafted under earlier guidance may need updating to reflect the Garante's current expectations regarding sub-processor controls, audit rights, and deletion obligations.
Appoint or verify your local representative. Organisations established outside the EU that process data of Italian residents may be required to designate a representative in Italy under EU data protection legislation. Confirm whether this obligation applies and, if so, that a proper appointment is in place and documented.
Review records of processing activities. The Garante has requested records of processing activities from organisations under investigation as a first step. Maintaining accurate, up-to-date records is both a legal obligation and a practical defence. Organisations that cannot produce these records promptly face compounded liability.
For comprehensive support on GDPR compliance and data protection obligations in Italy, our team is available to assist with audits, gap assessments, and remediation planning.
For parallel developments in an EU member state with a comparable enforcement trajectory, our alert on data protection enforcement in Portugal sets out comparable action items relevant to Iberian market operations.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. Our data protection practice supports international companies operating in Italy and across Europe on GDPR compliance, Garante investigations, consent architecture, data transfer programmes, and processor agreement frameworks. Engaging a lawyer in Italy with cross-border experience is particularly important when the Garante's enforcement actions intersect with multi-jurisdictional data flows. As an international law firm operating across Italy and other EU markets, Ferraz & Whitmore combines Portuguese civil law expertise with English common law tradition to deliver practical, results-oriented counsel. Our team has advised data controllers and data processors across both civil law and common law systems, and participates in cross-border practice groups focused on EU data protection regulation. To discuss your organisation's exposure and compliance priorities in Italy, contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.