All news
Italian DPA January 29, 2026 3 min

Italian DPA 2026 inspection plan: data breach, whistleblowing, AI in schools

Decision 797/2025: 40 inspections in the first half, with Tax Police support

With decision No. 797 of December 30, 2025, the Italian Data Protection Authority launched the inspection activities plan for the first half of 2026. At least 40 inspections are planned, conducted also with the support of the Tax Police (Guardia di Finanza).

Sectors under scrutiny

  • Data breaches on databases of particular relevance (banking and financial sector)
  • Whistleblowing: proper functioning of internal reporting channels under Legislative Decree 24/2023
  • Electronic health dossier (structure, access, profiling)
  • Telemarketing in the energy sector (lead acquisition, double opt-in, code of conduct)
  • Use of AI tools in school environments (NEW area)
  • Customs information system
  • Pseudonymization and sharing of telco big data

Points of attention for the DPO

If your client falls into one of the above sectors, it's time to do targeted internal audit. Verify Art. 30 record, data breach procedures, DPIA for high-risk processing activities. An inspection without adequate preparation generates fines even on formal documentary shortcomings.

What to prepare if you're in banking

  • Formalized data breach management procedure with timing and responsibilities (in light of the Intesa Sanpaolo 31.8M fine)
  • Detailed audit trail on database access
  • Documentation of risk assessments on customer management systems
  • Evidence of customer notices on all processing activities, including intra-group

What to prepare if you're in education

  • Complete mapping of AI tools in use (teaching, evaluation, student monitoring)
  • DPIA for every AI system processing minors' data
  • Clear legal basis for each processing activity
  • Notices to parents in understandable language (Art. 12 GDPR)

In DPO Workspace

Sector templates cover healthcare, PA, professional studios, commerce, and manufacturing. For banking and education sectors, in case of high demand we can add dedicated templates. Write to us via feedback if you need it.

Official source:Federprivacy: 2026 Inspection Plan

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Italian DPA
29.10the day the time runs out to fix the pixels in your emails

The invisible pixel in the newsletter: time runs out on 29 October

By decision no. 284 of 17 April 2026, published in the Official Gazette no. 98 of 29 April, the Italian data protection authority set out the rules for tracking pixels in email and allowed six months to comply: the deadline is 29 October 2026. Individual open-tracking for marketing purposes requires the recipient's consent, subject to exceptions. Compliance checks are part of the inspection plan for the second half of the year. For a DPO the point is not a prohibition — there is none — but that a processing operation taken for granted for twenty years now needs a basis, a notice and a way to switch it off on its own.

Oct 16, 2026New 7 min
Italian DPA
€39kfor a refused access to GPS data

Italian DPA fines security firm €39,000: company-car GPS data withheld from a former employee

A dismissed guard asks for the data from the GPS fitted to his company car to defend himself in disciplinary proceedings. The company neither hands it over nor explains why. The Garante fines La Patria S.p.A. of Bologna and restates a rule many forget: a refusal must be reasoned too.

Sep 30, 2026New 5 min
Italian DPA
12keuro

Misconfigured document register: 12,000 euro fine for the Metropolitan City of Sassari

Following a data breach notification and a complaint, the Italian data protection authority fined the Metropolitan City of Sassari for misconfiguring its electronic document register, making documents containing personal data accessible to staff who, given their role and duties, were not authorised to process them. The fine is 12,000 euro, but the principle applies to every public body and every company running a document management system: filing is not a neutral activity, and a default of total visibility breaches the principles of integrity and confidentiality.

Jul 29, 2026 6 min