With its judgment of January 17, 2026 No. 984 (Pres. Tricomi, Rapp. Pazzi), the Italian Supreme Court established the final nature of the 120-day deadline for the exercise of the Italian DPA's sanctioning power. A ruling that brings clarity to a long-debated issue.
The case
The appellant challenged the qualification of the deadline as final, arguing a violation of Art. 143 of the Italian Privacy Code and Art. 8 of GDPR Regulation No. 2/2019. The DPA, through cross-appeal, argued instead that the deadline was merely procedural.
The Supreme Court rejected both alternative theses, confirming the final nature. Beyond 120 days the proceedings lapse and the sanction can no longer be imposed.
Why it matters for DPOs
- Those assisting clients in DPA enforcement can plead expiration once 120 days have passed
- The deadline starts from the formal complaint, not from when the report reaches the DPA
- Also applies to proceedings already started and not yet closed at the date of the judgment
- Expiration can also be detected ex officio by the court in opposition proceedings
What to do if you're in proceedings
ALWAYS document the exact date of the formal complaint received from the DPA. This is when the deadline starts. Keep the certified email of receipt.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
