All news
Regulation June 10, 2026 5 min

The Garante's 2026 inspection plan: six areas and how to be ready

Decision 797 of 30 December 2025 sets the H1 inspection areas. Data breaches in public databases top the list

TL;DR for the DPO

Decision 797 of 30 December 2025 sets the Garante's H1 2026 inspection areas. Inspections involve the Finance Police tech-fraud unit, so they can have criminal implications. Notice can be short.

Areas in focus

  • Data breaches in public databases, abusive access and resale of information
  • Large-scale processing and special categories
  • Security measures and the ability to demonstrate what was done (accountability)

The lesson from recent decisions

After Intesa Sanpaolo (EUR 31.8M) the standard is clear: not suffering an attack is not enough, you must be able to PROVE you did the right things. Documented self-assessment changes the sanctioning outcome.

Official source:Garante - Decision 797 of 30 December 2025

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min