← Data protection and cybercrime laws by country, compared
Italy: data protection law, cybercrimes, fines and penalties
The Garante enforces the GDPR with a focus on telemarketing and social engineering in telecoms and energy.
- Law
- GDPR
- Authority
- Garante per la protezione dei dati personali
- Max fine
- €20M or 4% (GDPR); e.g. Enel Energia €79M (2024)
- Breach notification
- 72h (GDPR)
- DPO
- Mandatory in GDPR art. 37 cases
Risks
- Telemarketing (Enel Energia, €79M)
- Social engineering (Wind Tre, €1.72M, Jul 2026)