The italian data protection authority's inspection programme for the second half of 2026

By resolution of 23 July 2026 (No. 584 in the Register of Decisions), the Italian Data Protection Authority (Garante per la protezione dei dati personali) identified the priorities for its inspection activities for the period from August to December 2026. These activities will be carried out by the Authority’s Office, also with the assistance of the Guardia di Finanza.

Areas of focus

The resolution identifies eleven thematic areas that will be the focus of the ex officio inspection activities, i.e. inspections conducted independently of complaints or reports:

1. processing of personal data in connection with geomarketing and neuromarketing activities;
2. processing activities included in electronic health records and carried out through medical apps;
3. continuation, within the interdepartmental task force, of checks into data breaches affecting particularly significant public databases, with a focus on security systems and database accessibility, in order to counter unauthorised access and the resale of confidential information;
4. processing carried out by entities providing public bodies with external Data Protection Officer (DPO) services;
5. processing carried out by municipalities for the management of social and welfare services, including with regard to the providers of the relevant software applications;
6. periodic checks on processing activities carried out within the Visa Information System;
7. verification of the implementation of the Guidelines issued by the Authority on 17 April 2026 concerning tracking pixels in email communications;
8. processing activities related to the use of artificial intelligence systems by municipalities and Local Health Authorities (ASLs);
9. continuation of checks on processing activities carried out within the Customs Information System;
10. checks and technical assessments concerning personal data breaches notified to the Authority, with particular regard to the most extensive and sensitive cases, in both the public and private sectors;
11. fact-finding and verification activities concerning processing activities related to dynamic pricing.

These areas are supplemented by a catch-all provision allowing for further ex officio inspections in cases of particular urgency or following reports and complaints.

Numbers and operational arrangements

The Data Protection Authority has established that the inspection activities relating to the areas identified will cover at least 35 inspection proceedings, also carried out with the support of the Guardia di Finanza pursuant to the memorandum of understanding between the two authorities. The Office will inform the Authority’s Board on a monthly basis of the entities inspected in the first eight thematic areas and will report, at the end of the six-month period, on the overall progress of the inspection and investigative activities carried out.

One point is worth noting: some of the priorities confirm lines of action already initiated under the inspection programme for the previous six-month period (Resolution No. 797 of 30 December 2025), such as checks concerning the Customs Information System and data breaches involving public databases. Others, by contrast, appear to be new or strengthened, particularly scrutiny of the use of artificial intelligence systems by municipalities and Local Health Authorities and the verification of the implementation of the Guidelines on tracking pixels in email communications, which were adopted only a few months before the resolution.

Implications for the organisations concerned

The resolution is programmatic in nature and does not identify the individual entities that will be inspected; their identification remains confidential until the relevant proceedings are initiated. Organisations operating in the sectors identified – particularly geomarketing and neuromarketing, digital health, external DPO services for public administrations, the management of municipal social and welfare services, email communications involving tracking technologies, artificial intelligence systems used in healthcare and by local authorities, and dynamic pricing – therefore have a clear indication of the areas on which the Data Protection Authority will focus its attention in the coming months. This provides them with an opportunity to assess in advance the compliance of their respective processing activities.