Italy

NTT Data Italia S.P.A

800,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2024-02-08.

Rank · Sector

#38

of 597 in Industry and Commerce

Rank · Italy

#38

of 543

Rank · All fines

#201

of 3,050

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2024-02-08
Controller / Processor: NTT Data Italia S.P.A
Sector: Industry and Commerce
Quoted Articles: Art. 28 (2) GDPR, Art. 33 (2) GDPR
Type of violation: Insufficient fulfilment of data breach notification obligations

Summary

The Italian DPA has imposed a fine of EUR 800,000 on NTT Data Italia S.P.A. The fine is related to the fine imposed on UniCredit (ETid-2227). UniCredit had contracted NTT to carry out vulnerability analyses and penetration tests. During its investigation, the DPA found that NTT had not notified UniCredit of a data breach in a timely manner. In addition, NTT had contracted another company to carry out vulnerability assessments and penetration tests without prior authorization from the bank as the data controller.

Open original source Links to the regulator's original publication or another source.