Italy's data protection authority, the Garante, issued 835 GDPR enforcement decisions in 2024 alone, according to CMS's GDPR Enforcement Tracker Report (2026 edition, cutoff March 1, 2026), more than triple the 263 decisions it closed in 2023. Those 835 decisions carried just roughly EUR 24 million in fines combined, a fraction of the record penalties associated with GDPR headlines elsewhere in Europe. The number of cases is climbing fast. The euro value per case is not.
How many GDPR decisions has Italy's Garante issued?
835 decisions in 2024, according to CMS's GDPR Enforcement Tracker Report, the highest annual count on record for the Italian authority and more than three times 2023's 263. That figure counts every formal decision the Garante published, including fines, corrective orders, and processing bans, not fines alone.
The jump is not explained by more inspections. The Garante actually ran fewer inspections in 2024, 130, than in 2023's 144, which means the increase in decisions reflects a faster pace of closing existing cases rather than a wave of new investigations opening at once.
How has Italy's GDPR enforcement changed since 2019?
Decision volume held roughly steady between 231 and 278 per year from 2019 through 2023, then nearly tripled in 2024, according to CMS's Italy-specific enforcement data. Inspections followed a different pattern entirely, spiking to 147 in 2019, collapsing to 21 in 2020, then climbing back into the 130 to 144 range from 2022 onward.
Figure 1: Italy GDPR enforcement decisions by year, 2019 to 2024. Source: CMS GDPR Enforcement Tracker Report (2026 edition), Italy country data.
Five years of a flat decision count followed by a single year that nearly triples it is not a gradual trend. It looks like a backlog the Garante worked through in 2024, and whether that pace holds through 2025 and 2026 is the open question CMS's next annual update should answer.
What is the average GDPR fine in Italy?
Roughly EUR 28,700 per decision in 2024, calculated by dividing CMS's reported EUR 24 million annual total by the 835 decisions issued that year. That average is a small fraction of the EUR 2.28 million EU-wide average fine reported in CMS's GDPR Enforcement Tracker Report 2026, and it has moved around sharply from year to year rather than trending in one direction.
Figure 2: Average GDPR fine per decision in Italy, 2019 to 2024, calculated by PrivacyTerms.io from CMS's annual decision and fine totals. Source: CMS GDPR Enforcement Tracker Report (2026 edition).
2020's average, near EUR 138,300 per decision, was pulled up by a small number of large fines against telecom and financial firms that year. Most individual Italian decisions look nothing like that outlier: a July 2025 fine of EUR 420,000 against a company that used an employee's private Facebook, WhatsApp, and Messenger messages in a disciplinary case, and an April 2025 fine of just EUR 50,000 against the Lombardy Region for retaining employee email metadata and browsing logs far longer than its own guidelines allow, are closer to what a typical Garante decision actually costs.
Businesses collecting personal data from Italian users can close the most common gap behind cases like these, unclear legal basis and stale processing disclosures, with a privacy policy generator built for GDPR that keeps consent and legal-basis language current.
How much of Italy's 2024 fine total came from one company?
EUR 15 million of the roughly EUR 24 million Italy's Garante fined in all of 2024, about 62.5%, came from a single decision against OpenAI, issued December 20, 2024, over how ChatGPT's training data was processed. The fine broke down into EUR 9 million for processing personal data without an adequate legal basis, EUR 320,000 for failing to report a March 2023 data breach affecting Italian users, and EUR 5.68 million for not fully complying with corrective measures the Garante had already ordered in 2023.
Figure 3: Share of Italy's 2024 GDPR fine total from the OpenAI decision versus every other decision that year combined. Source: PrivacyTerms.io calculation from Lewis Silkin's case summary and CMS's 2024 Italy total.
OpenAI said at the time that it intended to appeal the decision as disproportionate, so this figure describes what the Garante imposed, not necessarily what OpenAI will ultimately pay once any appeal concludes. One company's single case setting the entire year's headline number is the same concentration pattern seen in other GDPR jurisdictions; see our breakdown of GDPR fines in Ireland's DPC data for how a single TikTok or Meta decision can do the same to a much larger cumulative total.
How much has Italy's Garante fined cumulatively since 2019?
Roughly EUR 96.4 million across 2,091 recorded decisions from 2019 through 2024, based on PrivacyTerms.io's calculation summing CMS's reported yearly totals for Italy. Complete 2025 figures were not yet publicly available as of CMS's March 2026 cutoff, so this total should be read as current through the end of 2024 rather than fully up to date.
Figure 4: Cumulative GDPR fines imposed by Italy's Garante, 2019 to 2024. Source: PrivacyTerms.io calculation from CMS's GDPR Enforcement Tracker Report (2026 edition).
That EUR 96.4 million is a small share of the roughly EUR 6.11 billion CMS's tracker records across the entire EU as of its March 2026 cutoff, drawn from 2,685 fines with complete published information. For the full continent-wide picture behind that number, including the countries responsible for the biggest single fines, see our GDPR fines statistics for 2026. Spain remains the most active regulator by fine count at 1,048, while Italy sits in the next tier alongside Romania and Poland, the three together issuing between 106 and 490 published fines each.
How does Italy's enforcement activity compare by year?
| Year | Decisions | Total fines (EUR) | Inspections |
|---|---|---|---|
| 2019 | 232 | 3,017,363 | 147 |
| 2020 | 278 | 38,448,895 | 21 |
| 2021 | 252 | 13,465,148 | 49 |
| 2022 | 231 | 9,459,457 | 140 |
| 2023 | 263 | 7,977,343 | 144 |
| 2024 | 835 | ~24,000,000 | 130 |
Source: CMS GDPR Enforcement Tracker Report (2026 edition), Italy country data.
2024 stands apart on every column but one: the euro total actually sits below three of the five prior years, which is the clearest evidence that Italy's enforcement surge is about closing more cases, not imposing bigger ones.
The Bottom Line
835 GDPR decisions in a single year is not a small enforcement program, but the euro totals behind that number tell a more modest story than the case count suggests. Most of Italy's 2024 fine total came from one decision against OpenAI, and the typical Garante case, like the EUR 420,000 employee-chats fine or the EUR 50,000 Lombardy Region metadata case, costs a small fraction of what regulators in Ireland or under the EU's biggest platform cases impose. For a business collecting personal data from Italian users, the practical lesson is the same either way: legal basis, transparency, and metadata retention are the violations that keep showing up in Garante decisions, and all three are cheaper to fix in a current privacy policy than to defend after a decision is published.
Frequently Asked Questions
How many GDPR decisions did Italy's Garante issue in 2024? 835 decisions, according to CMS's GDPR Enforcement Tracker Report (2026 edition), more than triple the 263 decisions Italy's Garante issued in 2023 and the highest annual count on record for the authority.
What is the largest GDPR fine Italy's Garante issued recently? EUR 15 million against OpenAI, issued December 20, 2024, over unlawful ChatGPT training data processing, transparency failures, and a delayed data breach notification. OpenAI said it would appeal the decision as disproportionate.
What is the average GDPR fine in Italy? Roughly EUR 28,700 per decision in 2024, well below the EUR 2.28 million EU-wide average reported by CMS's GDPR Enforcement Tracker Report 2026, because Italy's Garante issues a high volume of smaller corrective fines rather than a few giant platform-scale penalties.
How much has Italy's Garante fined cumulatively since 2019? Roughly EUR 96.4 million across 2,091 recorded decisions from 2019 through 2024, based on PrivacyTerms.io's calculation from CMS's published yearly figures. Complete 2025 totals were not yet publicly available as of the report's March 2026 cutoff.
Where the Numbers Come From
- CMS International Law Firm. (2026). "GDPR Enforcement Tracker Report, Italy Country Data." 2026 edition. 835 decisions and roughly EUR 24 million in fines for 2024, plus the full 2019 to 2024 annual breakdown by decisions, fines, and inspections.
- CMS International Law Firm. (2026). "GDPR Enforcement Tracker Report, Executive Summary." 7th edition, published May 21, 2026, editorial cutoff March 1, 2026. EUR 6.11 billion EU-wide total, 2,685 fines with complete information, EUR 2.28 million average fine, Spain's 1,048 fines, and Italy's tier alongside Romania and Poland.
- Lewis Silkin. (2025). "OpenAI Faces EUR 15 Million Fine as the Italian Garante Strikes Again." January 14, 2025. December 20, 2024 decision, EUR 15 million fine breakdown, and OpenAI's stated intent to appeal.
- DLA Piper Privacy Matters. (2025). "Italy: Garante Issues Fine for Use of Employee's Private Chats in Disciplinary Actions in the Workplace." July 21, 2025. EUR 420,000 fine over unauthorized use of an employee's private Facebook, WhatsApp, and Messenger communications.
- DLA Piper Privacy Matters. (2025). "Italy: The Garante Issues First GDPR Fine Over Employees Email Metadata Privacy Breach." June 4, 2025. EUR 50,000 fine against the Lombardy Region over email metadata and browsing log retention.
Note: All figures verified as of October 2026. The EUR 96.4 million cumulative total and the per-decision average fine figures in this post are PrivacyTerms.io's own calculations, run on CMS's individually published annual totals for Italy; CMS itself does not publish a single cumulative Italy figure. Italy's enforcement data is refreshed at least twice a year as CMS publishes new editions of its Enforcement Tracker Report.
