In March 2026, the Italian DPA fined Enel Energia over EUR 500,000 for telemarketing violations. The case is part of broader enforcement activity on the energy sector, considered high-risk under the 2026 inspection plan.
Charges identified
- Promotional calls to subjects who had not given express consent
- Failure to respect entries in the public opposition register (RPO)
- Lack of verification on external lead suppliers
- Failure to adopt the Code of Conduct for telemarketing and teleselling
The critical point
The DPA reiterated that double opt-in consent documentation 'offers greater guarantees and can be considered, at the state of the art, a minimum protection measure for the data subject'. Single opt-in is no longer enough to demonstrate lawful processing.
What to do if your client does telemarketing
- Implement double opt-in with email confirmation of consent (confirmation log preserved)
- Annual audit on lead suppliers: documentary questionnaires + on-site inspections
- Adopt the Code of Conduct for telemarketing approved by the DPA
- RPO check before every outbound campaign (daily alignment)
- Document legal basis for every number called (even if purchased from third parties)
In DPO Workspace
In Art. 30 processing activities of a client doing telemarketing, mark with status 'To review' the following: 'Lead acquisition', 'Outbound campaigns', 'Marketing consent management'. So you don't forget to review them annually.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
