Italy: Data Subject Rights

Access RightGreen

Access and other Art.15-22 rights must receive an adequate, timely response under Art.12; failure led to a formal admonishment in a 2026 decision.

Claims (1):

• The Garante issued a formal admonishment under Art.58(2)(b) GDPR against a controller for failing to comply with Art.12 obligations to provide an adequate and timely response to rights exercised under Arts.15-22 GDPR.

Rectification And ErasureGreen

Erasure/rectification obligations (Art.16-17 GDPR) are enforced, e.g. in minor-image publication cases requiring takedown upon parental request.

Claims (1):

• The Garante has repeatedly ordered controllers/individuals to cease further processing of a minor's image absent both parents' consent, treating unlawful publication as requiring takedown under Art.17(1)(d) GDPR.

Restriction And ObjectionGreen

The right to object to direct-marketing processing is operationalised nationally via the Registro Pubblico delle Opposizioni (RPO); failure to timely register an opposition has been sanctioned.

Claims (1):

• A telemarketing company was sanctioned for failing to timely register a data subject's opposition made via formal notice, despite repeated follow-up, confirming the RPO/objection mechanism as an enforceable data-subject right.

Data PortabilityGreen

Portability (Art.20 GDPR) applies directly as EU law; no Italy-specific derogation identified in this cycle.

Absence provenance: No dedicated Garante portability guidance/enforcement item surfaced in this pass; general GDPR Art.20 applies.. Searched: Garante data portability guidance Italy 2026.

Deadlines And Response WindowsGreen

Controllers must provide adequate and timely responses to rights requests under Art.12; the Garante has rejected staff-absence (holiday period) as an excuse for delay.

Claims (1):

• The Garante held that a company's summer holiday period could not excuse a controller from its ongoing obligation to respond to data-subject rights requests without undue delay.