Technical-Legal Memorandum

Deadlines in proceedings before the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority): analysis of Supreme Court (Corte di Cassazione, Civil Section I) judgments No. 22791/2026, 24861/2026 and 24862/2026. Operational implications and defense guidelines.

1. Case-law framework: the distinction between the three deadlines

The Supreme Court has definitively clarified that, within the data protection sanctioning system, three types of deadlines coexist, each with distinct functions and legal regimes:

Deadline for resolving the complaint (9–12 months | Art. 143(3) of the Italian Privacy Code)

Nature: Procedural deadline established solely for the protection of the complainant.

Legal effect: The Authority’s failure to meet this deadline does not result in the expiry of its sanctioning power. The sanctioning procedure is autonomous and is not extinguished if the complaint is resolved after 12 months.

Deadline for notification of charges (120 days / 360 days for parties abroad | Annex B to Garante Regulation No. 2/2019)

Nature: Peremptory intra-procedural deadline.

Legal effect: Applies exclusively to the formal notification stage of the infringements (the start of the adversarial phase). If notification is late, the act is void and the sanctioning power is extinguished.

Nature of the Dies a Quo (start of the calculation) (Cass. 24862/2026): The 120 days do not begin to run from mere awareness of the facts, but from the “definitive finding” (definitivo accertamento) — that is, from the moment the Garante has all the objective and subjective elements necessary to characterize the infringement.

Deadline for issuing the final decision / Order-Injunction (5 years | Art. 28 of Law No. 689/1981)

Nature: Limitation period for the sanctioning power.

Legal effect: Once charges have been notified on time (within 120 days of the definitive finding), there is no additional 120-day intra-procedural deadline for issuing the final sanction. The Authority’s only limit is the five-year limitation period, calculated from the commission or cessation of the unlawful conduct and subject to the ordinary grounds for interruption.

2. Synthesis of precedents and resolution of inconsistencies (Cass. 984/2026)

The consolidation expressed in judgments No. 24861 and 24862/2026 resolves the uncertainty generated by earlier, isolated rulings (such as Cass. 984/2026), which had erroneously conflated the charge-notification stage with the adoption of the sanctioning decision, incorrectly applying the 120-day deadline to the issuance of the final decision.

The Supreme Court reiterates that the investigation or preliminary-inquiry stage has no fixed peremptory deadline, but it remains subject to a reasonableness review by the ordinary courts: a judge may annul the sanction upon finding that the Garante unjustifiably delayed the investigative activity before formalizing the “definitive finding.”

3. Operational checklist for assessing the deadlines

To assess the formal legality of a sanction issued by the Garante, the organization’s defense must analytically reconstruct the following chronological sequence:

4. Practical implications for consulting services and for clients (data controllers)

For Data Controllers/Processors (Clients)

Financial reserve planning: A sanctioning procedure initiated by the Garante is not “extinguished” 12 months after the response to the complaint. The financial risk of the sanction should remain reflected in the accounts for up to 5 years after the infringement ceases.

Record (log) and evidence retention: Since the final sanction may arrive even years after the notification of charges, it is necessary to lock down and retain all IT records, policies, and defense evidence corresponding to the time of the facts until the five-year limitation period concludes.

For Privacy Consultants and Legal Advisors

Opposition strategy focused on the Dies a Quo: When challenging the sanctioning decision, the appeal should no longer be based on the delay in adopting the final sanction (an argument now definitively overruled by the Supreme Court), but on the disproportionate length of time taken in the pre-investigation phase.

Reasonableness review of investigations: If an unjustified period of time elapses between the Garante’s receipt of the information and the alleged “definitive finding,” without genuine investigative needs, the deviation of the dies a quo (start date of the calculation) should be argued before the court in order to trigger the expiry of the 120-day peremptory deadline.