GDPR Sanction Deadlines: The Supreme Court on the Dies A Quo

1. The facts

   The case originates from a sanction imposed by the Data Protection Authority on a company following a data breach notification spontaneously made by the data controller. According to reports from publications such as Diritto Bancario and Agenda Digitale, the Authority proceeded with the formal notification of the offense more than 120 days after receiving the initial communication. In the lower court proceedings, the Tribunal upheld the company's objection, declaring the injunction null and void for untimely notification, ruling that the deadline should have started immediately after the breach was reported. The case reached the Supreme Court of Cassation following an appeal by the Authority. The Supreme Court, in its recent ruling, overturned the lower court decision, clarifying that the mere receipt of news of an offense or a self-report does not necessarily coincide with the moment of definitive assessment of the violation, which instead requires a complex evaluation of the subjective and objective elements of the case.

2. 

   The rules in play

   The legal framework is based on the integration of general administrative sanction regulations and the GDPR.

   1. Article 14 of Law 689/1981 establishes that the notification must be served within precise deadlines from the assessment, a concept that case law must define based on the complexity of the investigation.
   2. Article 166 of the Privacy Code (Legislative Decree 196/2003) and the Authority's internal regulation set the mandatory deadline for notification at 120 days following the assessment.
   3. Article 83 of the GDPR requires administrative fines to be effective and dissuasive, but their application must respect the principles of legality and legal certainty provided by the national legal system. The function of these rules is to ensure that the administration cannot keep a subject under investigation for an indefinite period, while allowing the Authority to perform necessary technical checks before formalizing the charge.

3. Case law analysis

   The Supreme Court's jurisprudence has consolidated a rigorous orientation on the distinction between the phase of acquiring news and the actual assessment. The judges clarified that the dies a quo for the 120-day term cannot be mechanically equated with the date the Authority receives the data breach report. On the contrary, the assessment is considered complete only when the Authority has gained full awareness of the existence of the violation, its severity, and the controller's liability. This process may include requests for additional documentation and technical audits that are not subject to limitation periods, provided the investigative activity is carried out within reasonable times. The pivotal principle is that the limitation period has a guarantee function for the citizen but cannot be used to paralyze the Authority's action before it has the minimum elements to formulate a well-founded charge.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Do not consider the Authority's silence after a data breach notification as an implicit dismissal, but constantly monitor the status of the proceedings.
   2. Precisely document every interaction with the Authority, as the date of the last clarification provided could become the decisive moment for the forfeiture calculation.
   3. Evaluate the untimeliness objection not just on the total time elapsed, but on the appropriateness of the time spent on the investigation relative to the technical complexity of the case.

References: Articolo 14 Legge 689/1981Articolo 166 D.Lgs. 196/2003Regolamento UE 2016/679 (GDPR)

Editorial oversight: Avv. Federico Papa·ICAMUpdated 12 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction