Data privacy and data protection in Italy

DLA Piper

DLA Piper handles data protection compliance and contentious issues, which arise from European and US companies' global privacy projects, data breach-related disputes and innovative projects involving the exploitation of personal data. Giulio Coraggio is a technology, privacy and gaming specialist, and Giulia Zappaterra specialises in privacy and data protection projects.

Key clients

Goldman Sachs





21st Century Fox

Kering group companies




Work highlights

  • Advised Audi, Daimler and Porsche on the data protection issues surrounding the establishment of their e-commerce platforms and connected-cars services.
  • Acted for Luxottica on its GDPR compliance project across a number of European jurisdictions, which involved major privacy law issues.
  • Assisted Goldman Sachs with the roll-out of its global GDPR project, which marked one of the market’s most significant privacy-related projects.

Hogan Lovells International LLP

Hogan Lovells International LLP advises Italian and international clients on compliance with GDPR and 2018's Privacy Code reform. The team also regularly liaises with Italian Data Protection Authority (DPA) officers on privacy and data protection issues, and assists with matters involving the use of data, including litigation before the DPA and ordinary courts. Massimiliano Masnada's experience covers mobile technology, social media, connected cars, telemedicine, cloud computing, online tracking, and cross-border data transfers, where he handles contentious and non-contentious matters.

Practice head(s):

Massimiliano Masnada


The team has fantastic knowledge of privacy and data protection.

Its experience has been developed over many years, long before privacy became a hot topic. The team’s great knowledge of law and of the market means it provides advice that is always relevant, focused and business oriented.

Massimiliano Masnada is great as both litigator and compliance counsel. He is one of the biggest experts in privacy law in Italy – very passionate about his work, always reliable and eager to help even in real time.

Key clients

Google Group

AXA Group



Santander Consumer Bank

Banca PSA

Italian government’s digital team



Work highlights

  • Advising TeamSystem with product development-related privacy matters.
  • Assisted the Italian government’s digital team with developing a privacy model under the GDPR.
  • Advising Google on privacy and right to be forgotten cases.

Portolano Cavallo

Portolano Cavallo has longstanding data privacy and data protection expertise. Laura Liguori's privacy expertise includes user-generated content, data scraping, social networks, cybersecurity, protection of databases, data mining, big data and predictive analysis of data. In relation to data protection, she advises on profiling, cookies, employee monitoring, whistleblowing hotlines, location-based services, and cross-border data transfers. Privacy and data protection specialist Giulio Novellini was promoted to counsel.

Practice head(s):

Laura Liguori


This practice, which offers speedy solutions, has young partners who have a smart and collaborative approach. Project teams are built with the right mix of proficiency, communication skills and customer care.

Laura Liguori and counsel Giulio Novellini are available, responsive, efficient and committed.


BonelliErede fields experts in the regulated sectors, particularly banking, insurance and healthcare. The team regularly advises on interactions with the DPA, inspections, investigations and proceedings, and the data and privacy protection aspects of outsourcing agreements and commercial and technology joint ventures. Other areas are internet of things (IoT)-related exploitation of data and the application of AI models, overseas data transfer, and the analysis of data flows and compliance programmes. Tommaso Faelli leads the innovation and digital transformation focus team.

Practice head(s):

Tommaso Faelli


Chiomenti's department, headed by regulated markets specialist Gilberto Nava, recently managed data protection issues involving the IT, telecoms, banking, insurance, energy and automotive sectors. Typical work includes day-to-day and strategic data protection issues, including transfer of data, profiling, internal investigations, online and offline policies, and the development of machine learning-based services. Recently promoted counsel Giulio Vecchi expertise in the media, technology, and entertainment sectors, and associate Adriano D’Ottavio, who is experienced in privacy, data protection and security, was a new hire from Portolano Cavallo.

Practice head(s):

Gilberto Nava


All the lawyers give positive solutions and help clients find different ways to approach the legal options.

The team is highly professional and focused on solving problems.

Gilberto Nava and Giulio Vecchi are outstanding. Gilberto has great knowledge of clients’ business, helping them focus attention on the key issues rather than ancillary problems. Vecchi heads straight for the problems fast, and helps negotiate and win difficult legal problems.

Key clients



Toyota Financial Services – International Corporation

Toyota Insurance Management


Yoox Net-À-Porter Group

Enel X


Intesa Sanpaolo



Hic Mobile

ANIA – Associazione Nazionale fra le Imprese Assicuratrici

Agile Telecom

Stevanato Group

Work highlights

  • Advised Yoox Net-À-Porter Group on compliance issues surrounding the data processing activities carried out by third-party providers on its behalf.
  • Acted for Enel X Financial Services on drafting the general terms and conditions of use for a new application called Enel X and the relevant GDPR privacy information notice.
  • Assisting Terna Group companies with a broad spectrum of data protection matters.


Dentons recently hired Giangiacomo Olivi from DLA Piper as Europe co-head of the data privacy and cybersecurity group and Europe co-head of the media sector group. Olivi provides strategical and commercial legal advice on technology, media and communications matters, with a specific focus on data management and digital transformation. The practice has developed expertise in data privacy and data protection, including the EU General Data Protection Regulation (GDPR) aspects of international data privacy projects. Senior counsel Saverio Cavalcanti is a privacy and data protection expert.

Practice head(s):

Giangiacomo Olivi


It has the ability to define the ownership of the data and therefore the responsibility towards third parties. Competence at high levels is unquestionable and the determining factor is the trust that comes from the depth of the team’s personal qualities.

Key clients


Bolton Group


Octo Telematics


Warner Bros


Accorhotels Italia

Théa Pharma


Work highlights

  • Advised QVC, a telesales broadcaster, on the review of its data management policies and compliance programmes.
  • Acted for NTT Data, an international system integration company, on sensitive technology and data privacy projects, including an assessment of innovative technology applications and complex data processing.
  • Advised Bolton Group, a company that produces and markets high-quality consumer products, on GDPR implementation.

Gianni & Origoni

Gianni & Origoni is experienced in highly regulated sectors including financial services, energy, telecoms and media. The department assists with the setting up of data protection compliance systems; implementing data protection systems for digital start-up companies and multinationals; establishing privacy by design programmes; reviewing data protection regulation policies; and representing companies in DPA cases involving compliance scenarios and investigations. Daniele Vecchi specialises in privacy and data protection, and counsel Melissa Marchese advises on data protection management issues, including IT aspects.

Practice head(s):

Daniele Vecchi; Melissa Marchese


The team is always available, delivering timely and precise responses.

Key clients


Garofalo Healthcare


Sky Italia

Interactive thinking (Doing)




Montenapoleone district


Banco Santander

Work highlights

  • Advised Sky Italia on various data protection issues.
  • Assisted BeMyEye with data protection assessments.
  • Advised Garofalo Health-Care on the implementation of a GDPR compliance programme.

ICT Legal Consulting

ICT Legal Consulting specialises in data protection and cybersecurity compliance matters. Core areas are privacy, IT, IP and telecoms, including matters involving e-health, cloud computing, e-commerce, big data and analytics, and the IoT.  Paolo Balboni is a privacy and data protection expert, and Luca Bolognini is current President of the Italian Institute for Privacy and Data Valorisation, a think tank dedicated to advanced data protection studies in Italy.

Practice head(s):

Paolo Balboni; Luca Bolognini


They are all not only very competent in data protection matters but also extremely accurate and careful to understand clients’ needs. Moreover, response times are very swift and the advice is precise, business oriented and looking to the future.

The quality of lawyers is very good.

Luca Bolognini’s work is outstanding. He is able to deal with very complex privacy contexts that also involve cross-border considerations, and he advises in an accurate and business-sensitive manner.

Key clients



Amnesty International Sezione Italiana



Axpo Italia

BPER Banca

Brunello Cucinelli

Cerved Information Solutions

CNA Servizi Bologna

Ferrero International

Friul Intagli Industries

Giochi Preziosi


Kruk Italia



Soft Strategy


United Nations High Commissioner for Refugees


Università Campus Bio-Medico di Roma

Value Retail Management Italy

Virgin Active Italia

Work highlights

  • Acts for Virgin Active Italia as Data Protection Officer (DPO) on outsourcing, ensuring compliance with the data protection legislation.
  • Advised Ferrero International on the development and submission of its binding corporate rules to facilitate the transfer of personal data.
  • Assists various clients with managing data breaches.

Orsingher Ortu – Avvocati Associati

Orsingher Ortu – Avvocati Associati's practice covers technology, internet and e-commerce, advertising, media and entertainment, and telecoms. Its work includes drafting corporate policies, data processing agreements, information notices, cybersecurity, data breach management, and proceedings before the ordinary courts and the DPA. The team also assists with the management of data protection issues relating to outsourcing deals and compliance. Domenico Colella is an IT specialist and Fabrizio Sanna is a TMT sector expert.

Practice head(s):

Fabrizio Sanna


The partners are of exceptional quality, have excellent knowledge of clients’ sectors and are efficient at delivering the legal product.

Key clients



ITV Global Entertainment






Borsa Italiana



Egon Zendher


Antares Vision


Work highlights

  • Advised FC Internazionale Milano on its GDPR compliance project.
  • Provides ongoing advice to ItaliaOnline, including data protection matters.
  • Assisted Fujitsu’s Italian subsidiary with GDPR compliance.

Studio Professionale Associato a Baker & McKenzie

Studio Professionale Associato a Baker & McKenzie advises multinational companies on all aspects of data privacy, data security and information management at a global level. Francesca Gaudino is responsible for the data privacy, data security and information management practice in Italy. She is particularly focused on the legal issues surrounding the use of cutting-edge technology.

Practice head(s):

Francesca Gaudino


Provides exceptional know-how, on-time availability, great collaborative spirit, and understanding of the non-legal aspects of technical topics.

Francesca Gaudino has the great ability to explain complex issues in simple words; her patience and assertiveness allow her to relate with great efficiency to all levels of management.

Key clients

VF Group

EU Commission

Work highlights

  • Advised VF International, a global apparel company, on the internalisation of technology and digital-based initiatives, including a GDPR project.
  • Assisted the EU Commission with a  research project that aims to build a GDPR compliance-related IT toolkit for companies.

Legance - Avvocati Associati

Legance - Avvocati Associati advises on the application of data protection laws and their interaction with corporate, banking, antitrust and labour law. Representative work includes the establishment of privacy organisational charts; data protection by design and default in relation to the development of new technologies; and the processing of data involving criminal offences as well as the healthcare sector. The department also assists with DPA proceedings. Andrea Fedi is a compliance specialist, and senior associate Lucio Scudiero advises on data protection issues.

Practice head(s):

Andrea Fedi

Key clients



Ferriera Valsider

Hausmann & Co.



Nuovo Pignone International


Selle Royal


Just Eat Italy

Work highlights

  • Advised Mediobanca on personal data issues.
  • Acted for Kolbrain on privacy law issues.
  • Advised Just Eat Italy on adapting riders’ employment contracts in accordance with privacy laws.

Nctm Studio Legale

Nctm Studio Legale regularly advises on privacy and personal data protection, IT and cybersecurity, privacy policies, web reputation, e-commerce, e-discovery and forensic investigation. Paolo Gallarati is particularly focused on the TMT, pharmaceutical, and oil and gas sectors.

Practice head(s):

Paolo Gallarati


The extremely available team has an outstanding capacity to be business oriented and provides strong, practical legal advice.

Paolo Gallarati has extensive experience in data privacy laws and supports clients with high-quality, sound advice.

Key clients

Vaillant Group Italia



Greenpeace Italia

Hilti Italia

Wind Tre




Poste Italiane

Philip Morris Italia

Gilead Sciences


Fresenius Kabi Italia

Work highlights

  • Assisted Teresianum Pontificial University with implementing GDPR.
  • Advised NTV on a remediation plan in order to be compliant with GDPR.
  • Advised Fresenius Kabi Italia on GDPR compliance, including internal procedures, personal data protection policy, privacy notices and data processing agreements.

Orrick, Herrington & Sutcliffe

Orrick, Herrington & Sutcliffe advises on data protection compliance requirements as well as on contentious data privacy matters. Its clients are from a variety of industry sectors, including insurance and financial institutions, pharmaceutical and life sciences, transportation and infrastructure, energy and telecoms. Alessandro De Nicola is highly regarded for corporate governance and related compliance matters, and senior associate Ivan Rotunno is a privacy and data protection specialist.


Senior associate Ivan Rotunno has a deep understanding of privacy matters as well as complex cybersecurity issues. He is very responsive and customer oriented, and clients particularly appreciate his ability to think out of the box by providing innovative solutions in a timely manner.

Key clients

Coca-Cola Italia

Aeroporti di Roma







F2i Fondi Italiani per le Infrastrutture Società di Gestione del Risparmio

Rothschild & Co Italia

CNP Unicredit Vita

Tirreno Power

BNP Paribas Asset Management France – Milan branch


Roche Diagnostics

Flowserve Italia

Worthington Italia


Osborne Clarke

Osborne Clarke regularly co-ordinates data protection advice across Europe. The team also has significant experience of contentious data protection issues, including cybersecurity and major data breaches. The client base includes traditional manufacturers, investment banks, automotive companies, retailers and energy companies, in addition to growing areas including ad-tech, fintech and social media. Gianluigi Marino advises on the digital transformation of business processes and the mitigation of risks associated with information security and information management.

Practice head(s):

Gianluigi Marino


This cohesive team knows what works and is always available to exchange views on new topics and questions.

Gianluigi Marino is always available and provides prompt and effective answers and opinions. In addition, he knows the market, is always updated and informed about new laws and decisions and orientations, and finds the best way to address clients’ business needs.

Key clients





Grifols Italia

Binda Italia

Engie Italia

Mail Boxes


Mediobanca – Banca di Credito Finanziario

Integral Ad Science

Work highlights

  • Assisted AutoScout24, Italy’s largest online platform for vehicle sales, with a range of data protection, data processing and privacy issues.
  • Advised AI and e-commerce company Tooso on a range of data protection and privacy issues, including a significant GDPR compliance exercise within the context of an M&A transaction.
  • Advised beauty product retailer Re-Forme on data protection issues in the context of its customer relationship management processes, website structure and marketing campaigns.