The expiry of one year from the filing of a complaint with the Italian Data Protection Authority does not result in the Authority losing its power to establish an infringement and impose an administrative fine.

This is one of the main clarifications provided by the Civil Division of the Italian Supreme Court of Cassation in Judgment No. 24861 of 31 August 2026, which addresses the distinct functions of the time limits applicable, respectively, to the handling of complaints and to the subsequent exercise of the Authority’s sanctioning powers.

The dispute arose from a decision by which the Authority imposed a EUR 20,000 administrative fine on a publishing company for having disclosed, in a newspaper article, personal data relating to the children of a person convicted of child abuse. The Authority considered the processing unlawful, inter alia, in light of the principle of essentiality of information and the right to be forgotten.

The complaint had been filed on 27 May 2021. Following the investigative phase, the Authority initiated sanctioning proceedings on 23 November of the same year, while the final sanctioning decision was adopted on 2 March 2023 and served on 20 March 2023.

The company challenged the lawfulness of the fine, arguing that the Authority had forfeited its sanctioning powers because the one-year time limit for concluding the complaint procedure had expired.

The Supreme Court rejected that argument, clarifying that the one-year time limit applicable to the conclusion of proceedings initiated by a complaint is merely directory rather than mandatory. Its purpose is to ensure that the data subject who has lodged the complaint receives a timely determination of his or her case, but it does not constitute the final deadline within which the Authority must exercise its separate powers to contest and sanction infringements.

According to the Court, proceedings initiated by a complaint and administrative sanctioning proceedings cannot be treated as a single and identical procedure. The latter are governed by a separate legal framework and may be initiated by the Authority on the basis of infringements identified during its investigations, even where those investigations were originally triggered by a report or complaint.

Accordingly, the expiry of the one-year period does not, in itself, extinguish the Authority’s sanctioning powers.

In determining the time limits within which those powers may be exercised, regard must instead also be had to the general rules on administrative sanctions laid down in Law No. 689 of 24 November 1981. In particular, Article 28 provides for a five-year limitation period running from the date on which the infringement was committed.

The 120-day period applicable to the notification of alleged infringements serves a different purpose. That period – extended to 360 days for persons residing abroad – does not concern the adoption of the final decision imposing the sanction, but rather the service of the notice of alleged infringement on the person concerned.

The Supreme Court further reaffirmed that the 120-day period does not begin to run when the Authority first becomes aware of a possible infringement. Rather, the dies a quo is the point at which the investigative activity has enabled the Authority to reach a sufficiently complete determination of the alleged unlawful conduct.

The mere receipt of a report, complaint or other initial information does not therefore amount to a final finding of infringement. The duration of the investigative phase must nevertheless be assessed in accordance with criteria of reasonableness and appropriateness, having regard to the characteristics and complexity of the individual case.

The judgment follows the approach already adopted by the Supreme Court in Judgment No. 18583 of 8 July 2025, according to which the Authority’s activity aimed at imposing sanctions must be divided into two distinct stages: first, a preliminary investigative and fact-finding phase, aimed at gathering and assessing the information necessary to determine whether an infringement has occurred; and, second, the sanctioning phase in the strict sense.

It is only in relation to the latter stage that the mandatory 120-day time limit laid down in Regulation No. 2/2019 of the Italian Data Protection Authority for service of the notice of alleged infringement becomes relevant. By contrast, the applicable legal framework does not establish an equivalent mandatory time limit for the completion of the preliminary investigative phase.

The decision is particularly significant for companies and controllers involved in proceedings before the Italian Data Protection Authority, since it requires a clear distinction to be drawn between three separate timeframes: the time limit for the conclusion of the complaint procedure, which is merely directory; the period within which the notice of alleged infringement must be served following the final determination of the infringement; and the general limitation period applicable to the Authority’s sanctioning powers.

It follows that the overall duration of the proceedings is not, in itself, sufficient to establish that the Authority has forfeited its powers. For the purpose of determining whether the notice of alleged infringement was served in due time, the decisive issue is instead to identify the point at which, in light of the investigative activity actually carried out, the infringement could be regarded as having been definitively established.