Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Italy enforces GDPR through the Garante per la protezione dei dati personali. Italy was one of the few member states to meet the NIS2 deadline, transposing via Legislative Decree 138/2024 (in force since 16 October 2024), with ACN as the competent authority overseeing more than 20,000 registered entities.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Italy without transposition.
SourceItaly's national data protection code, originally enacted in 2003 and substantially amended by Legislative Decree 101/2018 to align with GDPR.
SourceItaly's NIS2 transposition decree, published 1 October 2024 and in force since 16 October 2024, confirming ACN as the competent NIS authority alongside nine sectoral ministries.
Source72 hours
GDPR Article 33 applies uniformly: notify the Garante without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: Garante per la protezione dei dati personali
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceD.Lgs. 138/2024 (NIS2)
Up to €10,000,000 or 2% of total annual worldwide turnover for essential entities (excluding public administrations); up to €7,000,000 or 1.4% for important entities
SourceApplicable , as of 2026-09-08
Fully transposed and in force since 16 October 2024, one day ahead of the EU deadline, via Legislative Decree 138/2024. ACN is the competent NIS authority and single point of contact, supported by nine sectoral ministries. Over 30,000 organizations had filed registration declarations by the close of the first registration window (28 February 2025); ACN confirmed more than 20,000 NIS subjects (over 5,000 of them essential entities) by April 2025. Incident-reporting obligations for registered entities apply from January 2026, with full security-measure compliance due by October 2026.
SourceGarante per la protezione dei dati personali(Garante)
Visit authority siteYes. Italy transposed NIS2 via Legislative Decree 138/2024, in force since 16 October 2024, one of the few EU member states to meet the original deadline. ACN oversees registration and compliance, with full security-measure obligations due by October 2026.
Under D.Lgs. 138/2024, essential entities (excluding public administrations) face fines up to €10 million or 2% of worldwide annual turnover, while important entities face up to €7 million or 1.4% of turnover.
The Garante per la protezione dei dati personali, Italy's independent data protection authority, notification is due within 72 hours where feasible, per GDPR Article 33.
Talk to us about scoping an engagement around your specific regulatory context.
