Italy: Data Protection

An employee at Intesa Sanpaolo unlawfully accessed thousands of customer records over two years, leading to a €31.8 million fine from Italy's data protection authority. The ruling underscores that insider threats demand proactive, risk-based controls and that unauthorised access alone—even without data extraction—triggers serious breach notification obligations under GDPR.

The European Commission's Digital Omnibus Package proposes significant amendments to the AI Act, introducing targeted simplification measures for high-risk AI systems, extending regulatory relief to small-to-medium companies, and clarifying the interaction between AI regulation and existing EU legislation. The European Parliament has already published proposed amendments, with final adoption expected by the end of 2026 and gradual implementation beginning in 2027.

Law No. 132 (the Italian Artificial Intelligence Act) took effect on 10 October 2025.1 Under the Italian AI Act, at least one implementing decree that defines an "organic framework" for data, algorithms and artificial intelligence (AI)-training methods is due by October 2026.

Regulatory sandboxes allow companies to test innovative technological products within a controlled real-world environment under a specific framework developed and monitored by one or more competent authorities, for a limited period of time.

意大利数据保护机构（Garante Per La Protezione Dei Dati Personali，以下简称GPDP）近期对美国公司OpenAI OpCo, LLC（ChatGPT的开发者）采取了处罚措施。

At the end of 2024 the Italian Data Protection Authority issued a 15 million euro fine in the first generative AI-related case brought under GDPR. According to Garante (the Italian authority)...

Cybersecurity Comparative Guide for the jurisdiction of Italy, check out our comparative guides section to compare across multiple countries

Artificial Intelligence is a strategic priority, but it requires great attention to the risks involved. Here, AlixPartners explores a series of successful, carefully-constructed GenAI adoption strategies...

The Italian Data Protection Authority has adopted an updated version of a guideline document on email retention that it originally issued in December 2023, but which had been suspended.