#
Framework is GDPR-aligned and enforced robustly, but repeated large fines for DPIA/retention/security gaps (Poste Italiane, public-sector breaches) indicate ongoing compliance friction.
Sub-modules (7)
Accountability And DpiaAmber
Poste Italiane and PostePay were fined EUR 12.5M in April 2026 in part for failing to conduct adequate DPIAs.
Claims (1):
- The Garante fined Poste Italiane S.p.A. EUR 6,624,000 and PostePay S.p.A. EUR 5,877,000 (total EUR 12,501,000) partly because the companies failed to conduct adequate data protection impact assessments regarding mandatory device-monitoring authorizations in the BancoPosta/Postepay apps.
Dpo RequirementsAmber
Controllers must communicate DPO data/changes to the Garante; a municipality's failure to do so contributed to a 2026 sanction.
Claims (1):
- The Comune di Mirabella Imbaccari was found non-compliant with GDPR partly for not communicating a change in its DPO's data to the Garante, alongside unlawful online disclosure of personal data.
Ropa RequirementsGreen
Art.30 GDPR ROPA duties apply directly as EU law; no Italy-specific ROPA enforcement case was located in this cycle.
Absence provenance: No dedicated ROPA-specific enforcement decision surfaced in this pass.. Searched: Garante ROPA registro delle attività di trattamento sanzione.
Joint Controller ArrangementsAmber
Marketing-data supply chains involving multiple controllers (data broker, buyer, sub-processor) were scrutinised in a 2026 telemarketing case examining controller allocation across Depurazione Acqua, Conversion Media and Unleadmited.
Claims (1):
- In a 2026 telemarketing case, the Garante examined the controller/processor allocation of responsibility across a data-collection platform (Unleadmited), a data broker (Conversion Media) and an end-client (Depurazione Acqua) for marketing-data sharing.
Security MeasuresAmber
The Poste Italiane/PostePay decision found the companies failed to adopt appropriate security measures for app-based device-monitoring processing.
Claims (1):
- Poste Italiane and PostePay were found to have failed to adopt appropriate security measures in connection with mandatory device-monitoring processing represented as necessary for fraud prevention.
Breach NotificationAmber
The Garante actively sanctions breach-notification and post-breach handling failures, including a 2026 decision against Città Metropolitana di Sassari and a separate case against a municipality for unlawful online disclosure of personal data over several years.
Claims (1):
- The Garante sanctioned Città Metropolitana di Sassari in a 2026 data-breach case, as reported in the Authority's 29 July 2026 newsletter of enforcement actions.
Retention And DisposalAmber
Poste Italiane/PostePay were found to have undefined retention limits and shortcomings in data-retention policy design.
Claims (1):
- The Poste Italiane/PostePay decision identified shortcomings in data-retention policies and undefined retention limits as among the compliance failures underlying the EUR 12.5M fine.
Controller/Processor Duties
Businesses, platforms and newsletter operators in Italy must bring tracking-pixel-related privacy notices, consent mechanisms and withdrawal mechanisms into line with the Garante's Linee guida sui tracking pixel by 29 October 2026. This compliance deadline was reiterated in the Garante's newsletter of 8-9 October 2026; the underlying guidelines themselves entered into force before this cycle's reporting window, so what is new this cycle is the regulator's active reiteration of an approaching deadline rather than a change to the underlying substantive obligation. The guidelines' own legal-instrument citation has not been independently retrieved this cycle, so the precise statutory or regulatory basis for the guidelines cannot be stated with full precision at this time.
The practical effect for controllers and processors operating tracking pixels on websites, platforms or in email newsletters is that consent capture, notice content, and withdrawal mechanisms tied to pixel-based tracking must be reviewed and, where necessary, remediated ahead of the deadline. The Garante's active reiteration of the deadline through its public newsletter channel suggests the regulator is treating this as a live compliance priority rather than a routine, low-visibility requirement.
Outlook
The 29 October 2026 deadline is imminent. Entities operating tracking pixels without current alignment to the Garante's guidelines face a narrow remaining window to achieve compliance. Watch for whether the Garante follows the deadline with enforcement activity against non-compliant operators, which would indicate the reiterated deadline functions as an active enforcement trigger rather than a guidance reminder without immediate consequence.
3 earlier distinct update(s)
Controller/Processor Duties
The Garante's IQVIA decision, provvedimento n. 710 of 23 September 2026, made three distinct findings on accountability and controllership. First, the company had not defined data retention periods for data that, in some cases, dated back to 2001 — a failure to set and apply a retention policy consistent with the data-minimisation and storage-limitation principles. Second, IQVIA had not carried out a data protection impact assessment despite processing health data at scale. Third, the Garante found IQVIA had not adopted adequate security measures for the dataset in question. A 120-day compliance deadline, running from notification of the decision, was imposed to remedy these failures.
On controllership itself, the Garante held that IQVIA was the data controller from the point at which it collected data at the offices of the roughly 800 general practitioners involved, rejecting any characterisation that would place controllership solely with the GPs themselves. This finding is significant for any data-aggregation or data-intermediation business model built around collecting data from a dispersed network of independent professional sources: the point of collection, not merely the point of onward use, can anchor controllership.
The same proceeding reportedly absorbed a separate procedure concerning a personal-data breach that IQVIA had itself notified to the Garante, suggesting the breach notification and the substantive processing failures were considered together in reaching the Eur7 million sanction, though the precise weighting between the two strands was not detailed in the secondary reporting reviewed this cycle.
Outlook
The 120-day compliance deadline imposed on IQVIA is a concrete marker to watch: confirmation of IQVIA's remedial steps, including retention-period definition, a completed DPIA, and enhanced security measures, would indicate how the Garante expects compliance to be demonstrated following a controllership-and-accountability finding of this kind.
Controller/Processor Duties
The Garante's Provvedimento n. 237, dated 17 April 2026, sanctioned Poste Italiane and its PostePay division for unlawful monitoring of applications installed on users' Android devices. This matter falls squarely within the controller/processor duties framework because it turns on the adequacy of security-of-processing measures and the accountability obligations that attach to a controller operating consumer-facing mobile applications. Monitoring the applications installed on a user's device, beyond what is necessary for the stated purpose of the service being provided, raises questions of purpose limitation and data minimisation that sit at the heart of the controller's accountability obligations under the framework the Garante enforces.
While the sanction itself is reported at a probable confidence level, drawing on a secondary summary rather than direct retrieval of the full text of Provvedimento n. 237, the underlying pattern is consistent with the Garante's established enforcement posture toward large consumer-facing financial and postal-services groups: security-of-processing failures involving device-level data collection have previously drawn Garante attention, and this action continues that pattern. The involvement of PostePay, a payment-services brand operating under the broader Poste Italiane group, places the matter within a sector where the Garante has historically maintained close scrutiny given the scale of the consumer base involved.
For controllers operating consumer mobile applications in Italy, the practical implication is that monitoring practices extending to the broader set of applications installed on a user's device, rather than being confined to the data strictly necessary for the service's own functionality, present a live enforcement risk. The accountability principle requires that any such monitoring be justified by a documented, proportionate purpose and be transparent to the data subject; absent that justification, the Garante has shown itself willing to sanction on exactly this fact pattern.
Outlook
The Poste Italiane/PostePay sanction should be read as a signal that the Garante continues to treat device-level application monitoring as a live enforcement priority within its broader controller/processor duties remit. Operators of consumer-facing mobile applications in the Italian market, particularly within financial and postal services, should expect continuing scrutiny of similar monitoring practices. No further detail on the full scope or remedial requirements of Provvedimento n. 237 was available in the sources reviewed this cycle, and confirmation from a primary Garante publication would strengthen the evidentiary basis for this finding in a future cycle.
Controller/Processor Duties
The Garante's controller/processor duties enforcement this cycle centres on data-minimisation and retention accountability. On 24 February 2026, the Garante issued an order concerning Amazon worker-data record-keeping practices, addressing excess data retention in the employment context. Separately, on 29 April 2026, the Garante issued guidance against accommodation providers retaining copies of guest identity documents, a similar retention-minimisation intervention in the hospitality sector. Both are Probable-confidence findings, sourced from the Garante's own Tier-1 press-room index, though the full text of the underlying provvedimenti was not retrieved this cycle, which limits the granularity of what can be reported about the specific corrective measures ordered in each case.
Taken together, these two orders confirm active accountability and data-minimisation enforcement by the Garante across at least two distinct sectors, employment and hospitality, within a single reporting window. This pattern is consistent with tightening in this module's trajectory, reflecting a regulator actively testing retention practices against the GDPR's data-minimisation and storage-limitation principles rather than confining enforcement attention to breach-notification or consent failures alone.
Outlook
Watch for the full text of both the Amazon worker-data order and the accommodation-provider guidance to become available, which would allow a more granular assessment of what data-retention thresholds the Garante is now applying, and for whether this retention-focused enforcement pattern extends to further sectors in the coming cycle.
Sources and claims (6)
- ConfirmedDataGuidance — The Garante fined Poste Italiane S.p.A. EUR 6,624,000 and PostePay S.p.A. EUR 5,877,000 (total EUR 12,501,000) partly because the companies failed to conduct adequate data protection impact assessments regarding mandatory device-monitoring authorizations in the BancoPosta/Postepay apps.observed
- ConfirmedGarante Privacy — The Comune di Mirabella Imbaccari was found non-compliant with GDPR partly for not communicating a change in its DPO's data to the Garante, alongside unlawful online disclosure of personal data.observed
- ConfirmedGarante Privacy — In a 2026 telemarketing case, the Garante examined the controller/processor allocation of responsibility across a data-collection platform (Unleadmited), a data broker (Conversion Media) and an end-client (Depurazione Acqua) for marketing-data sharing.observed
- ConfirmedDataGuidance — Poste Italiane and PostePay were found to have failed to adopt appropriate security measures in connection with mandatory device-monitoring processing represented as necessary for fraud prevention.observed
- ProbableGarante Privacy — The Garante sanctioned Città Metropolitana di Sassari in a 2026 data-breach case, as reported in the Authority's 29 July 2026 newsletter of enforcement actions.observed
- ConfirmedDataGuidance — The Poste Italiane/PostePay decision identified shortcomings in data-retention policies and undefined retention limits as among the compliance failures underlying the EUR 12.5M fine.observed