Skip to main content

The Italian Data Protection Authority Published Its Annual Report: In 2019, Public And Private Entities Notified 1443 Data Breaches


The annual report summaries the different issues on which the Italian Data Protection Authority (“Italian DPA” or “Authority”) worked over the past year; it also shows the state of implementation of privacy legislation in Italy, as well as an overview of the data breaches notified and the related measures taken.

Compliance to GDPR by companies and public administration, protection of fundamental rights in the digital world, first sanctions and monitoring interventions, cybersecurity, data breaches, risks related to the use of digital assistants/smart speakers and cyberbullying are the main issues covered by the Italian DPA in 2019 and presented in the annual report.

With specific reference to the report carried out by the Authority on data breaches notified in 2019, the Italian DPA highlights that 1,443 notifications of data breaches were received in one year, involving, as data controllers, public entities (in 27% of cases) and private entities (in the remaining 73%).    

The number of notifications made in 2019 is significantly higher than in 2018, when data controllers notified 630 data breaches to the Authority since the 25 May 2018, date on which the GDPR came into force.    

As shown by the reports published by the Italian DPA, both in 2018 and 2019 the most frequent types of databreaches concerned:

  • cyber attacks aimed at acquiring personal data, such as credentials access, data related to payment instrument, contact details;
  • unauthorized access to e-mail accounts (ordinary and certified);
  • loss or unavailability of personal data caused by ransomware malware;
  • loss or theft of digital devices or paper documents containing personal data;
  • accidental disclosure or dissemination of personal data.

 The clear increase of the number of data breach notifications recorded in 2019, compared to 2018, underlines a significant higher awareness of public and private entities regarding personal data breaches registered in their organizations.

In its annual report the Italian DPA stressed also that the priority objectives of the investigation activities carried out by its departments following the notification of a data breach have been:  

  • the assessment of the measures taken by the data controller (or intended to be taken by the controller) to remedy the data breach or to mitigate its possible negative effects on data subjects; and
  • the assessment of the opportunity to notify the infringement to the data subjects involved in the data breach, providing them with specific indications on the measures to be taken to protect themselves from any harmful consequences.

 In cases where the infringement revealed a possible inadequacy of the measures taken by the data controller, the Authority carried out the inspection activity in order to acquire the elements necessary to identify the organizational and technical weaknesses from which the notified breaches originated. This detailed investigation led the Italian DPA to the adoption of prescriptive and, in the most serious cases, sanctioning collegial measures.

In order to mitigate the risks arising from any kind of data breaches, it is essential that data controllers and data processors:

  • draft and provide a policy for the management of data breaches;
  • provide specific training on data beach to the personnel;
  • draw up and constantly update a record of data breaches.


Article provided by: Chiara Agostini (R&P Legal, Italy)



Discover more about INPLP, the INPLP-Members and the GDPR-FINE database

Dr. Tobias Höllwarth (Managing Director INPLP)



Cloud Privacy Check (CPC). Data Privacy Compliance in the Cloud Made Easy

Understand Cloud and Data Protection Law in only 4 easy steps. Plus highly relevant legal information for 33 countries. Provided by EuroCloud and 53 European lawyers.


About Us

EuroCloud is an independent non-profit organization and consists of a two-tier setup where organisations form all European countries can apply to participate in as long as they respect the EuroCloud Statutes.

To act as a true European player, all programs that are developed are intended to be European activities. These European programs are the strength of EuroCloud as a whole. Respect to local cultures along with the will to promote a real European spirit.