Italian privacy fines: the 120-day deadline for formal notice

In the commentary “Sanzioni privacy, la Cassazione chiarisce la regola dei 120 giorni”, published by AgendaDigitale on 8 September 2026 and republished on the Italian data protection authority’s website, Luigi Montuori, the authority’s secretary general, examines Court of Cassation judgments Nos. 24861 and 24862 of 2026. On his reading, the 120-day deadline concerns the Italian regulator’s formal notification of an alleged infringement, rather than the imposition of the final penalty. The full judgments have not been directly verified: this account of their contents remains attributed to the commentary.

According to Montuori, the deadline under Table B of the authority’s Regulation No. 2/2019 starts when the infringement has been definitively established. Simply receiving information is insufficient: the authority must be able to assess every constituent element of the infringement. The account of judgment No. 24862 also highlights the need to obtain the company’s response before formulating the allegation. The deadline is described as mandatory, with failure to comply extinguishing the obligation to pay the monetary penalty.

The commentary also distinguishes complaint proceedings from penalty proceedings, governed respectively by Articles 143 and 166 of Italy’s Privacy Code. Under the interpretation reported, the one-year deadline for deciding a complaint therefore does not extinguish the authority’s independently initiated power to impose penalties. For the final penalty order, the analysis cites the five-year limitation period under Article 28 of Law No. 689/1981, running from the commission of the infringement, without an additional, separate deadline extinguishing that power. It nevertheless states that evidence gathering and assessment remain subject to judicial review of whether the time taken was reasonable, without allowing unjustified delays.