TL;DR for the DPO
Trenitalia communicated a data breach to customers about eight months after the attack. Key reminder: Art. 33 (notification to the authority within 72h) and Art. 34 (communication to data subjects without undue delay, if the risk is high) are SEPARATE duties. A late communication defeats the purpose of Art. 34: enabling people to defend themselves right away (change passwords, distrust suspicious emails, monitor accounts).
The three points that matter
- Communication to data subjects serves THEM, not the controller: changing credentials, raising the guard against phishing, monitoring transactions. After eight months, damage from targeted phishing may already be done.
- The Intesa case (EUR 31.8M) already showed that the authority weighs TIMING and completeness too: notifications formally 'complete' but substantially lacking, or supplemented late, worsen the controller's position.
- If you choose NOT to communicate (risk not high, or Art. 34(3) exceptions apply), document that assessment immediately, in writing: it is the only credible defence in an investigation.
What to do now, in practice
Every client's breach plan must have TWO tracks with their own clocks: (1) assessment and notification to the authority within 72h; (2) assessment of the risk to data subjects and, if high, prompt communication with practical self-protection advice. Prepare communication templates BEFORE they are needed: nobody writes clearly in incident panic. The platform's 72h timer covers track 1; the event log documents track-2 decisions.
Why it matters for your clients
Every controller tends to postpone communicating to data subjects for fear of reputational damage. The paradox is that delay multiplies both the reputational damage (the news comes out anyway, and worse) and the sanction exposure. For a DPO this case is the concrete example to bring to training: fast transparency is also the cheapest strategy.
Official source:Federprivacy - Trenitalia communicates a data breach to customers eight months after the hack (4 July 2026)Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
