DATA PROTECTION | Italian Supreme Court clarifies the time limit for notifying data protection infringements

On 31 August 2026, the Italian Supreme Court, issued judgement No. 24862/2026, clarifiying the starting point of the 120-day time limit for the Italian Data Protection Authority (Italian DPA) to notify alleged data protection infringements. The case at stake concerned a company, which was sanctioned by the Italian DPA for having acted as a data processor without having been formally appointed as such. At first, the Italian DPA requested information from the controller, which replied on 3 February 2020. After remaining substantially inactive for a significant period of time, the Italian DPA sought information directly from the company under investigation, which replied on 13 July 2021. The alleged infringement was notified to the data processor on 30 July 2021.

Under point 2 of Annex B to Regulation no. 2/2019 of the Italian DPA, which implements Article 166(5) of the Italian Privacy Code, the Italian DPA must notify alleged infringements within 120 days of their ascertainment where the addressee resides in Italy, or within 360 days where the addressee resides abroad. The lower court upheld the data processor’s claim, according to which the 120-days mandatory terms for notification had started on 3 February 2020, date when the Italian DPA had knowledge of the infringement.

The Italian Supreme Court overturned that decision. Recalling its previous recent case law (judgements nos. 984/2026 and 18583/2025), it confirmed that the Italian DPA’s enforcement activity comprises two distinct stages: an investigative or preliminary phase and a subsequent sanctioning phase. The 120-day mandatory time limit concerns the latter and runs from the end of the investigation, that is when the Italian DPA ascertains that the breaches have occurred.

Newsletter n. 121 – August/September 2026