EDPB Launches Data Protection Guide For Small Businesses

Il Garante della Privacy ha sanzionato una società per aver negato a un ex dipendente l'accesso completo alla casella e-mail aziendale, chiarendo che anche le comunicazioni di lavoro costituiscono dati personali dell'assegnatario. La decisione stabilisce limiti precisi alle pratiche di oscuramento preventivo e definisce quando il diritto di accesso può essere legittimamente limitato.

Il Garante Privacy ha stabilito con provvedimento del 4 marzo 2026 che le attività di digital forensics nelle indagini interne aziendali costituiscono trattamento di dati personali soggetto alla normativa privacy.

Il Garante della Privacy avverte sui rischi dell'uso di sistemi AI per l'analisi dello stress lavorativo tramite sentiment analysis dei messaggi dei dipendenti, sottolineando la necessità di proteggere i dati personali e la dignità dei lavoratori.

The Italian Data Protection Authority has ruled against a company that denied a former employee complete access to their corporate email account, clarifying that work-related emails constitute personal data under GDPR. The decision addresses the boundaries of employee data access rights and establishes that employers cannot arbitrarily obscure or withhold work-related correspondence without specific legal justification.

The Italian Data Protection Authority has ruled that digital forensics activities conducted during internal corporate investigations must comply with data protection regulations. Following an anonymous whistleblowing report, a company's forensic examination of a senior executive's email and storage was deemed unlawful due to failures in information provision, data processor appointment, and adherence to data minimisation principles.

Data protection has become a critical risk issue for family offices, extending far beyond basic legal compliance.

An employee at Intesa Sanpaolo unlawfully accessed thousands of customer records over two years, leading to a €31.8 million fine from Italy's data protection authority. The ruling underscores that insider threats demand proactive, risk-based controls and that unauthorised access alone—even without data extraction—triggers serious breach notification obligations under GDPR.

Following numerous stop-and-go developments by the Regional Administrative Court (TAR) for Lazio, the Council of State, and the Court of Justice of the European Union regarding...

In today's digital economy, a growing number of organisations established outside the European Union (EU) are entering the EU market, by offering goods or services to individuals within the EU.

This is to inform you with complete transparency that we have detected an abusive access that has affected some of our systems, and may have affected some personal data.