Italy

Lidl Italia S.r.l.

43,000 €

GDPR enforcement action by Italian Data Protection Authority (Garante) on 2026-05-14.

Rank · Sector

#117

of 610 in Industry and Commerce

Rank · Italy

#133

of 573

Rank · All fines

#790

of 3,106

Case details

Authority: Italian Data Protection Authority (Garante)
Date: 2026-05-14
Controller / Processor: Lidl Italia S.r.l.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) a) GDPR, Art. 12 (2), (3) GDPR, Art. 15 (1) GDPR, Art. 18 (1) c) GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Italian DPA has imposed a fine of EUR 43,000 on Lidl Italia S.r.l. The data subject was involved in an altercation with employees of the controller in one of the controller's retail stores. Following this the data subject requested access to and retention of CCTV footage of the incident. The controller informed the data subject that the footage had been deleted, justifying their actions by citing the data subject's failure to submit their request in the required form. However the data subject did provide all the required information in their request for deletion and retention therefore non-compliance with their request was not justified.

Open original source Links to the regulator's original publication or another source.