---
title: "Italy — Data Subject Rights | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/italy/data-subject-rights/
source_html: /jurisdictions/italy/data-subject-rights/index.html
description: "Italy — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 4 claims Green ▾ # Rights framework is GDPR-aligned and actively enforced with concrete recent case law on response deadlines and"
generated_at: 2026-10-25T04:46:50Z
content_sha256: e2ace127380cd55ffe67795ba7a951a4b3e42265ffaa7e440d491f1ce37ffdd4
generator: "fe-fleet/md-twin@1.0"
---
# Italy — Data Subject Rights | Data Protection Monitor

### D3Data Subject Rights5 sub-modules4 claimsGreen▾#

Rights framework is GDPR-aligned and actively enforced with concrete recent case law on response deadlines and opposition rights.

Primary framework GDPR Arts. 12, 15-22 + Codice Privacy Artt. 2-decies, 130

Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/)

Traffic-light rationale — Green Rights framework is GDPR-aligned and actively enforced with concrete recent case law on response deadlines and opposition rights.

#### Sub-modules (5)

#### Access RightGreen

Access and other Art.15-22 rights must receive an adequate, timely response under Art.12; failure led to a formal admonishment in a 2026 decision.

Claims (1):

- The Garante issued a formal admonishment under Art.58(2)(b) GDPR against a controller for failing to comply with Art.12 obligations to provide an adequate and timely response to rights exercised under Arts.15-22 GDPR.

#### Rectification And ErasureGreen

Erasure/rectification obligations (Art.16-17 GDPR) are enforced, e.g. in minor-image publication cases requiring takedown upon parental request.

Claims (1):

- The Garante has repeatedly ordered controllers/individuals to cease further processing of a minor's image absent both parents' consent, treating unlawful publication as requiring takedown under Art.17(1)(d) GDPR.

#### Restriction And ObjectionGreen

The right to object to direct-marketing processing is operationalised nationally via the Registro Pubblico delle Opposizioni (RPO); failure to timely register an opposition has been sanctioned.

Claims (1):

- A telemarketing company was sanctioned for failing to timely register a data subject's opposition made via formal notice, despite repeated follow-up, confirming the RPO/objection mechanism as an enforceable data-subject right.

#### Data PortabilityGreen

Portability (Art.20 GDPR) applies directly as EU law; no Italy-specific derogation identified in this cycle.

Absence provenance: No dedicated Garante portability guidance/enforcement item surfaced in this pass; general GDPR Art.20 applies.. Searched: Garante data portability guidance Italy 2026.

#### Deadlines And Response WindowsGreen

Controllers must provide adequate and timely responses to rights requests under Art.12; the Garante has rejected staff-absence (holiday period) as an excuse for delay.

Claims (1):

- The Garante held that a company's summer holiday period could not excuse a controller from its ongoing obligation to respond to data-subject rights requests without undue delay.

Category narrative 43 words

Garante enforcement gives operative content to Arts.12 and 15-22 GDPR, requiring an adequate and timely response to rights requests, sanctioning controllers (including via formal admonishment) for delayed or absent responses, and treating opposition/telemarketing-suppression requests (Registro Pubblico delle Opposizioni) as an enforceable objection mechanism.

Evidence 4

Sources and claims (4)
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10241926) — The Garante issued a formal admonishment under Art.58(2)(b) GDPR against a controller for failing to comply with Art.12 obligations to provide an adequate and timely response to rights exercised under Arts.15-22 GDPR.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10181642) — The Garante has repeatedly ordered controllers/individuals to cease further processing of a minor's image absent both parents' consent, treating unlawful publication as requiring takedown under Art.17(1)(d) GDPR.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9921112) — A telemarketing company was sanctioned for failing to timely register a data subject's opposition made via formal notice, despite repeated follow-up, confirming the RPO/objection mechanism as an enforceable data-subject right.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10241926) — The Garante held that a company's summer holiday period could not excuse a controller from its ongoing obligation to respond to data-subject rights requests without undue delay.observed 2026-08-03