RPLegal&Tax Associazione Professionale

RPLT Law. Tax. Solutions. is an independent, multidisciplinary Italian law and tax firm, with roots dating back to 1949. RPLT brings together more than 200 lawyers and accountants, over 30 practice areas and 7 offices across Italy, combining specialized expertise with an integrated, business-oriented approach. Within the field of Privacy and Data Protection, RPLT assists companies and organizations in managing the legal and operational challenges arising from the processing of personal data, both in Italy and in an international context. Our team advises clients on GDPR compliance, data governance and the analysis and regulation of data flows within organizations, across corporate groups and with external stakeholders. We assist with the preparation and implementation of privacy notices, data processing agreements, records of processing activities, data transfer arrangements, cookie policies, internal procedures and other contractual and organizational measures required under applicable data protection legislation. We also provide support on specific projects and business activities involving personal data, including digital services, marketing and promotional initiatives, e-commerce, healthcare and pharmaceutical activities, as well as emerging technologies and artificial intelligence. Our lawyers regularly assist clients in the role of Data Protection Officer (DPO) and advise on data protection issues arising in connection with innovation, technology and new business models. We also handle relations with the Italian Data Protection Authority, including requests for clarification and inspections, as well as proceedings and litigation before the competent authorities and courts. RPLT's privacy practice is closely connected with its expertise in Intellectual Property, Advertising & Marketing, E-Commerce, TMT and Healthcare & Life Sciences, allowing clients to address data protection issues within the broader legal and business context in which they arise.

Representatives

Chiara Agostini

partner

Gianluca Morretta

member

Contact

Publications

• National AI legislation adopted in Italy: a first look at privacy implicationsItaly has become the first EU Member State to adopt a comprehensive national AI regulatory framework with Law No. 132 of 23 September 2025. The law adapts the Italian legal system to EU Regulation 2024/1689 (AI Act), introducing provisions that overlap with existing data protection regulation, particularly affecting healthcare data processing, worker information duties and transparency obligations in public administration.27 January 2026
• Video surveillance and artificial intelligence: sanctions against a Public Body by the Italian DPAWith the decision No. 5 of 2024, the Italian Data Protection Authority (“DPA”) penalised the Municipality of Trento for the unlawful data processing in two AI surveillance projects. The DPA stated that the AI systems used did not provide adequate data anonymization techniques and that there was the lack of a solid legal basis for data processing.25 June 2024
• ChaptGPT: the Italian Data Protection Authority leads the way and imposes GDPR compliance.The Italian Data Protection Authority recently gained international attention for being the first to address the privacy risks of generative artificial intelligence, ordering the temporary restriction of the Italians’ data processing to OpenAI because of the violation of several GDPR rules. With the implementation of several measures to improve the compliance of this AI system with the GDPR, ChatGPT is back online again in Italy.28 November 2023
• The privacy risks of the “virtual friend”: the Italian DPA clamps down ReplikaThe Italian Data Protection Authority (“Garante Privacy”) has ordered the limitation of the data processing activities carried out by the Replika chatbot due to minors’ data protection concerns.21 April 2023
• Right of access to data: the Italian Data Protection Authority fines company 70,000 euros for failure to respond fully.The Italian Data Protection Authority (“Garante Privacy”) has imposed a fine of 70,000 euros on a data controller for failing to provide complete, intelligible and easily accessible response to a request-submitted by one of its employees- to access to data processed as part of the employment relationship.1 December 2022
• Facial recognition systems: 20 million fine against the American company Clearview."Not everything that is technically possible is legally and ethically lawful." These are the words of Guido Scorza, member of the Italian Data Protection Authority, to describe the €20 million fine imposed last February by the Italian DPA on the US company Clearview AI Inc. for its facial recognition service.4 July 2022
• New Italian cookie Guidelines: this is how the regulation of users' browsing data changes.On 9 July 2021, the Italian DPA released the new guidelines on the use of cookies. The purpose of these new guidelines is to achieve an higher level of transparency and to obtain an unambiguous consent for profiling data processing.21 September 2021
• Data breaches in healthcare due to human errors: two hospitals and a Local Health Administration Unit sanctioned by the Italian Data Protection AuthorityData breaches are violations of database security that may result not only from cyber attacks, as it is usually assumed, but also from human errors committed by persons who, under the direct authority of the data controller or the data processor, are authorized to process personal data. The absence of corporate procedures for the proper handling of patient data within a healthcare facility throughout their lifecycle or the inadequacy of these policies to cover all possible cases, in particular, can lead to material errors being made by the staff, such as the communication of patient's data to persons other than the data subject or to unauthorised persons. Such breaches in the health sector have a potentially very serious and detrimental impact on the rights of data subjects, given the special nature of the data processed, which consist of information on a person's state of health. This issue has been the subject of three recent decisions of the Italian Data Protection Authority which are briefly described in this news.13 April 2021
• The Italian Data Protection Authority Published Its Annual Report: In 2019, Public And Private Entities Notified 1443 Data BreachesThe annual report summaries the different issues on which the Italian Data Protection Authority (“Italian DPA” or “Authority”) worked over the past year; it also shows the state of implementation of privacy legislation in Italy, as well as an overview of the data breaches notified and the related measures taken.24 August 2020
• Italian data protection authority against the unlawful data processing through telemarketing activitiesThe Italian Data protection Authority (Italian DPA) issued two fines against Tim and Eni Gas e Luce, for a total amount of almost 36 million euros, due to data processing for telemarketing purposes carried out without the data subjects’ consent.28 March 2020
• The Italian Data Protection Authority Limits the Sending of Advertising and Promotional Contents to Fidelity Cards HoldersFor the first time, the Italian Data Protection Authority has exercised its power of "warning" provided by the GDPR, through which it has prohibited the unconditional sending of unsolicited advertising contents to fidelity cards holders.20 August 2019
• Three Legal Opinions of the Italian DPA clarify some GDPR Implementation AspectsThe aim of this article is to focus on three important legal opinions published by the Italian Data Protection Authority on the application of GDPR to personal data of deceased persons, the existence of a possible duty to communicate employees’ personal data to their professional associations and the role of the labour consultant after the full implementation of GDPR.4 April 2019
• Joint Controllership Sub-group NewsDuring 2018, the Not-for-Profit International Network CPC set up some study groups with the aim to analyze and compare the Member States laws and Data Protection Authorities’ interpretations on some specific legal arrangements provided by the EU Regulation 679/2016, GDPR.13 December 2018