In two lines
Italian Supreme Court, First Civil Division, no. 22791/2026 and, from the same hearing of 24 June 2026 and filed on 31 August, nos. 24861 and 24862/2026. The 120-day period in table «B» of the DPA's regulation no. 2/2019 is an internal, mandatory deadline, but it concerns SERVICE OF THE CHARGE. For the final order there is no forfeiture: what remains is the five-year limitation period under Art. 28 of Law no. 689/1981.
Two procedures, not two phases
Judgment no. 24861/2026 — deciding the appeal by Società Editoriale Il Fatto S.p.A. against a EUR 20,000 fine for an article identifying the adult children of a man convicted of abusing minors — holds that the procedure for adopting corrective and sanctioning measures «takes the form of a further and distinct administrative procedure and not of a sub-procedure or another phase of the overall handling of the data subject's complaint». The nine months extendable to twelve under Art. 143 of the Italian Privacy Code concern the complaint; they do not mark «a final deadline for the exercise of the sanctioning power».
Judgment no. 24862/2026 comes from the authority's own appeal against a lower ruling that had gone against it. K-City S.r.l. had acted as external processor for the Municipality of Formia, on paid parking, between September 2019 and April 2020, without a proper appointment deed. The authority obtained clarifications from the municipality on 3 February 2020; it then asked K-City for information, receiving a reply on 13 July 2021; it served the charge on 30 July 2021, seventeen days later. The Court of Rome had run the 120 days from 3 February 2020 and annulled the order. The Supreme Court overturns: the definitive finding «does not consist in the mere acquisition of the notice, but requires the authority's ability to assess all the constitutive elements of the breach». Information about a third party — the municipality — does not start the clock towards the entity that will be fined.
The timeline as it emerges from the three judgments:
- Gathering and assessment phase: no mandatory deadline, but no unjustified delays caused by organisational failures. A court may review it for reasonableness and proportion to the complexity of the case.
- Definitive finding: it requires the actual hearing of the party to be sanctioned, not merely notice coming from third parties.
- From then, 120 days to serve the charge. Failure to comply extinguishes the pecuniary obligation.
- After a timely charge: no further forfeiture period. What remains is the five-year limitation running from the commission of the act (Art. 28, Law no. 689/1981).
- For comparison, the general model of Art. 14 of Law no. 689/1981: ninety days for residents in Italy, three hundred and sixty for residents abroad.
What changes for you, concretely
1) Date your replies. In the K-City case the moment you answer a request for information under Art. 157 is what brings the definitive finding closer: record and keep that date, because it is from there that the timeliness of the charge is measured. 2) Do not build a defence on the time elapsed between the first report and the charge: the Court said expressly that the preliminary phase has no predetermined deadline. Only delay caused by organisational failures remains attackable, and it must be proved. 3) Remember that the complaint does not lapse: if the authority exceeds the nine to twelve months, the data subject has recourse to the ordinary courts, and the sanctioning power stays intact. 4) Put in your calendar five years from the conduct, not from the charge: it is the only final deadline left.
Where this reading comes from, and why it matters
The most detailed account of these three judgments is the article by the authority's Secretary General, Luigi Montuori, published in AgendaDigitale on 8 September 2026 and taken up by the authority's newsletter. It is an authoritative, well-documented reading, with quotations referenced page by page — and it is also the authority's own reading of judgments about its own powers. Anyone building a defence should work from the text of the judgments, not from the summary: the substance does not change, but the emphasis on what remains reviewable — the reasonableness of the preliminary phase — is understandably lighter in the authority's own account.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
