In Italy, organisations handling personal data or operating critical infrastructure must navigate three overlapping notification regimes – GDPR, NIS2 and DORA – each with its own timelines, thresholds and competent authorities, including the Garante per la protezione dei dati personali as the primary data protection supervisor. Compliance is complicated by a live legislative proposal, the Digital Omnibus (COM(2025) 837), which would amend several of these regimes but has not yet been adopted and may still change substantially before entering into force. Understanding exactly which obligations apply today, and which remain subject to political negotiation, is essential for any company operating in or into the Italian market.
The Italian Regulatory Landscape: Three Regimes, One Organisation
Italy is an instructive jurisdiction precisely because its regulatory geography is dense. The Garante per la protezione dei dati personali enforces GDPR obligations and has developed a consistent enforcement posture since the Regulation became applicable in 2018. NIS2 – Directive (EU) 2022/2555 – required transposition into national law, and Italy has completed that process, embedding obligations on essential and important entities under domestic provisions that interact with pre-existing sectoral rules. DORA – Regulation (EU) 2022/2554 – applies directly to financial entities and their ICT third-party providers, placing the supervisory relationship with the Banca d'Italia and, for certain entities, CONSOB and IVASS alongside the European Supervisory Authorities.
This multi-authority environment creates a structural challenge. A single ransomware event affecting a bank or insurance undertaking organised as an S.r.l. may simultaneously trigger notification obligations to the Garante (GDPR), to the relevant NIS2 competent authority (for essential or important entities), and to financial supervisors under DORA. Each regime has distinct timelines, distinct thresholds and distinct documentation requirements. Conflating them, or treating notification to one authority as sufficient across all channels, is a risk that Italian enforcement experience has repeatedly exposed.
GDPR Notification: The 72-Hour Obligation and the Garante's Practice
Under Article 33 of the GDPR, a personal data breach must be notified to the Garante without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The clock starts from awareness, not from discovery at a technical level – a distinction the Garante has addressed in guidance and that national courts, including references to the Corte di Cassazione in administrative enforcement proceedings, have had cause to examine.
Italy's enforcement record under GDPR is significant. The Garante has issued some of the largest fines in the EU and has been notably active in the healthcare, telecommunications and public-sector segments. For international groups with Italian subsidiaries, the Garante's willingness to investigate proactively and to coordinate through the EDPB's one-stop-shop mechanism means that a breach affecting Italian data subjects will rarely remain a purely local matter. Data transfer considerations add a further dimension: where the breach involves personal data flowing from third countries into Italy, or from Italy to processors outside the EEA, the notification must address the transfer mechanism and the impact the breach may have on the lawfulness of that mechanism.
Article 34 imposes a parallel obligation to communicate the breach directly to affected individuals when the breach is likely to result in a high risk to their rights and freedoms. The threshold is higher than for authority notification, but the Garante treats failure to notify individuals as a separate and aggravating factor in penalty calculations.
If your organisation has experienced or suspects a personal data breach with Italian elements, our team can help you assess your notification obligations promptly. Contact us at info@ferrazwhitmore.com or visit our contacts page.
NIS2: Incident Reporting Timelines for Essential and Important Entities
The NIS2 Directive, transposed in Italy, establishes a three-stage reporting structure for significant incidents affecting essential and important entities. The stages are: an early warning within 24 hours of becoming aware of the incident; a more detailed incident notification within 72 hours; and a final report within one month. The competent authority and CSIRT Italia (under the Agenzia per la Cybersicurezza Nazionale, ACN) are the relevant recipients.
The sector coverage of NIS2 is broad and cuts across energy, transport, banking, financial market infrastructure, health, digital infrastructure and several other categories. Italian operators in these sectors must determine whether they qualify as essential or important entities under the transposing legislation, register accordingly, and maintain incident-response procedures that are aligned with ACN's technical guidance. Failure to notify a significant incident, or to notify within the applicable window, exposes both the entity and, under certain conditions, its management to administrative and potentially criminal consequences under Italian law.
One structural complexity for groups with operations in multiple Member States is that the NIS2 competent authority is national. An incident affecting Italian and non-Italian infrastructure simultaneously will require coordination of national notifications, with no single entry point currently mandated across the EU. This is one of the areas where the Digital Omnibus proposal – discussed below – would, if adopted, introduce changes.
DORA: Operational Resilience and the ICT-Related Incident Regime for Financial Entities
DORA entered into application on 17 January 2025 and applies directly to banks, investment firms, payment institutions, e-money institutions, insurance and reinsurance undertakings, and a range of other financial entities supervised under Italian and EU law. DORA introduces a classification of ICT-related incidents as either major or otherwise, with major incidents subject to mandatory reporting to competent authorities – primarily the Banca d'Italia and CONSOB depending on the entity type – via the Joint EU Hub coordinated by the European Supervisory Authorities.
DORA's incident reporting timeline requires an initial notification within 4 hours of classifying an incident as major (and no later than 24 hours from becoming aware), an intermediate report within 72 hours, and a final report within one month. These windows are tighter in certain respects than NIS2's equivalent stages, and they operate alongside, not instead of, any NIS2 or GDPR obligations that may also be triggered. A financial entity that is also an essential or important entity under NIS2, and that processes personal data, may therefore face three concurrent notification timelines following a single incident.
DORA also introduces enhanced requirements for managing ICT third-party risk, including contractual obligations vis-à-vis critical ICT third-party service providers. Where the provider is established outside Italy or outside the EU, this raises questions of jurisdiction and enforcement that Italian-law contractual frameworks – including standard S.r.l. service agreements and agreements that incorporate decreto ingiuntivo-accessible enforcement mechanisms – must be structured to address from the outset.
For financial institutions seeking a detailed review of their DORA compliance posture in Italy, our banking and finance practice in Italy can assist with gap analysis, contractual review and regulatory dialogue.
The Digital Omnibus Proposal: What Is Proposed, What Is Not Yet Law
The European Commission published the Digital Omnibus package (COM(2025) 837) on 19 November 2025. It is a proposal – currently in the ordinary legislative procedure – and as of the date of this analysis it has not been adopted. The final text may change materially before enactment, and no provisions of the proposal apply to any entity at this time.
The proposal includes targeted amendments to GDPR, the ePrivacy Directive, the Data Act, NIS2 and the CER Directive. Among the most debated amendments: raising the breach notification threshold under GDPR to incidents posing a high risk (rather than any risk) to individuals; extending the 72-hour notification deadline to 96 hours; and creating a single entry point for incident reporting across GDPR and NIS2. The EDPB–EDPS Joint Opinion 2/2026, issued on 10 February 2026, supported some of these changes – particularly the 96-hour extension and the single-entry-point concept – while opposing others, notably any narrowing of the definition of personal data and any softening of rules governing automated decision-making.
Separately, Regulation (EU) 2026/1744 – the Digital Omnibus on AI – was adopted and entered into force on 27 July 2026. This instrument does not alter the core GDPR, NIS2 or DORA notification timelines, but it interacts with them where AI systems process personal data or form part of critical infrastructure, and Italian entities deploying AI at scale should assess whether its provisions generate additional notification or transparency obligations.
For Italian entities, the practical consequence of the proposal's pending status is clear: GDPR compliance obligations, NIS2 incident reporting and DORA major-incident notification all remain fully applicable in their current form. Planning on the basis of the proposed changes would be premature and potentially exposes organisations to enforcement risk if the final text differs from the proposal or is delayed.
Intersection and Overlap: Managing Concurrent Notifications in Practice
The most significant operational risk for Italian entities is not any single regime but the interaction among all three. Consider a financial institution that qualifies as an essential entity under NIS2, processes large volumes of personal data, and relies on a critical ICT third-party provider. An incident that disrupts its services and exposes customer data may simultaneously trigger:
- A GDPR notification to the Garante within 72 hours if personal data is affected and there is a risk to individuals;
- An NIS2 early warning to ACN within 24 hours, followed by a full notification within 72 hours;
- A DORA initial notification to the Banca d'Italia (or CONSOB) within 4 hours of major incident classification, with an intermediate report within 72 hours.
These timelines are not aligned. The DORA 4-hour initial notification window begins from a classification decision that itself takes time to make, whereas the GDPR clock starts from organisational awareness. In practice, this means that an institution's crisis-response protocol must include near-simultaneous triage across all three frameworks, with pre-assigned leads for each regulatory channel, pre-drafted notification templates that can be populated quickly, and clear internal escalation routes.
It is worth noting that the Garante actively cooperates with ACN and, through the EDPB mechanism, with supervisors in other Member States. An Italian subsidiary of a multinational group cannot assume that notification to a lead supervisory authority in another Member State satisfies Italian obligations: NIS2 notifications are inherently national, and DORA supervisory relationships are anchored to the entity's home Member State for authorisation purposes. Groups that maintain a Registro delle Imprese entry in Italy for their operational subsidiaries should ensure that the notification chain includes the Italian entity's management and not only the group's central compliance function.
Liability: Personal, Corporate and Cross-Border Dimensions
Liability exposure under these regimes is multi-layered. Under GDPR, administrative fines of up to €20 million or 4% of total worldwide annual turnover may be imposed by the Garante for the most serious infringements, including failure to notify. NIS2 introduces supervisory and, in some Member States, personal liability for management-level individuals – Italian transposition has addressed this dimension, and senior officers of essential entities bear specific duties. DORA creates a framework in which competent authorities may require ICT-related incident root-cause analyses and impose measures on financial entities whose incident management is found deficient.
Civil liability is a separate dimension. Italian law permits data subjects to bring claims for material and non-material damage resulting from GDPR infringements, and the courts – including, at the highest level, the Corte di Cassazione – have addressed questions of burden of proof and quantification of non-material harm in data protection cases. An organisation that fails to notify a breach in time, or notifies it incompletely, may face not only regulatory sanctions but also a wave of individual claims, particularly where consumer data is involved at scale.
Cross-border liability arises where the same incident affects data subjects or entities in multiple jurisdictions. For groups with an Irish holding company, for example, GDPR notifications to the Irish Data Protection Commission do not displace the Garante's authority over processing specifically rooted in Italy. Our analysis of breach notification obligations in Ireland sets out the Irish framework in detail for comparative reference.
Strategic Recommendations for International Clients Operating in Italy
Organisations with material Italian operations should consider the following practical steps:
- Map your regulatory perimeter: Determine precisely which combination of GDPR, NIS2 and DORA applies to each Italian legal entity, taking into account sector, size, data processing activities and third-party dependencies.
- Build a unified incident-response protocol: A single protocol that assigns notification leads, timelines and templates for each regime is more reliable than three separate procedures that may conflict under pressure.
- Review third-party contracts: DORA requires contractual provisions with ICT providers that address incident notification; ensure that your Italian-law agreements include these provisions and that they are aligned with your internal timelines.
- Do not yet plan around the Digital Omnibus: The proposal's 96-hour deadline and single-entry-point concepts are attractive operationally, but they are not law. Your current obligations remain unchanged.
- Monitor the Garante's enforcement output: The Garante publishes decisions and guidance that clarify how it applies GDPR notification obligations in practice; this output is an essential complement to the Regulation's text for Italian compliance purposes.
- Engage legal counsel early after an incident: The notification windows are short. Pre-engagement with external counsel – including through standing retainer arrangements – is more effective than seeking advice after an incident has already been detected.
For organisations seeking to align their data protection infrastructure with Italy's evolving regulatory framework, our data protection practice in Italy advises on GDPR compliance, NIS2 obligations, incident response and supervisory engagement with the Garante.
Outlook
The trajectory of the Digital Omnibus proposal will be the principal development to track over the next twelve to eighteen months. If the ordinary legislative procedure moves quickly, entities may need to adapt their notification procedures to a revised GDPR threshold and a longer notification window – as well as to a single-entry-point mechanism that would simplify multi-regime reporting. However, the EDPB–EDPS Joint Opinion 2/2026 has signalled that some aspects of the proposal remain contested at the European level, and the final text cannot be assumed to mirror the Commission's initial draft.
In Italy specifically, ACN continues to develop its technical guidance for NIS2-covered entities, and the Garante's enforcement programme shows no sign of moderation. For international clients, the practical conclusion is that investment in robust, regime-aware incident-response infrastructure is justified regardless of how the legislative process develops: the current obligations are demanding, the timelines are short, and the liability consequences of non-compliance are material.
To discuss your organisation's specific notification obligations or incident-response framework in Italy, please reach out to our team at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.