Privacy & Data Protection

GDPR, data transfers, DPA proceedings

What we do

GDPR and D.Lgs. 196/2003 compliance (updated Italian Privacy Code): mapping, records of processing, privacy notices, DPA contracts under art. 28
International transfers of personal data (SCC 2021, BCR, TIA assessment under Schrems II, EU-US Data Privacy Framework)
Data breach notification to the Italian Data Protection Authority and data subjects (arts. 33-34 GDPR), crisis management
Data protection impact assessments (DPIA under art. 35 GDPR), prior consultation with the Italian Data Protection Authority (art. 36)
Investigations and sanctioning proceedings of the Italian Data Protection Authority, opposition before the Court and appeals to the Authority
GDPR / AI Act intersection (Reg. EU 2024/1689): data processing for model training, profiling, automated decision-making
Privacy by design in fintech, biometric, healthcare and scoring projects

Service pillars

GDPR compliance for companies and groups

Full mapping of processing activities, drafting of the Records under art. 30 GDPR, privacy notices to data subjects under arts. 13-14, management of specific consents. Drafting of controller-processor (DPA) contracts under art. 28 GDPR and joint controller agreements under art. 26 GDPR. Procedures for exercising data subject rights (access, rectification, erasure, portability, objection).

International transfers

Assessment of third country adequacy, application of Standard Contractual Clauses 2021/914, Binding Corporate Rules for multinational groups, codes of conduct. Transfer Impact Assessment under Schrems II (C-311/18) and EDPB recommendations 01/2020. Adherence to the EU-US Data Privacy Framework and post-Schrems risk management.

Data breach

Operational data breach management: incident assessment, risk assessment for data subjects' rights, notification to the Authority within 72 hours under art. 33 GDPR, communication to data subjects under art. 34. Coordination with IT, forensic, communication and legal teams for integrated crisis management.

DPIA and prior consultation

Data protection impact assessments for high-risk processing (biometric systems, large-scale profiling, scoring systems, extensive video surveillance). Prior consultation with the Authority under art. 36 GDPR when the DPIA signals high residual risk. Drafting of DPIA documents compliant with WP248 guidelines.

Privacy litigation

Investigation proceedings before the Italian Data Protection Authority, hearings, defence briefs. Opposition to Authority measures before the ordinary Court under art. 152 D.Lgs. 196/2003 and appeals to the Authority under art. 77 GDPR. Class actions and non-pecuniary damages from privacy violations under art. 82 GDPR.

Privacy in artificial intelligence

GDPR / AI Act intersection: lawfulness of processing for AI model training (legal bases, anonymisation, synthetic data), profiling and automated decision-making under art. 22 GDPR, integrated FRIA (Fundamental Rights Impact Assessment under art. 27 AI Act) + DPIA. Transparency of outputs and bias management.

Privacy by design in vertical sectors

Structuring of privacy-compliant processing in fintech projects (open banking, alternative credit scoring, digital KYC, biometrics and crypto wallets), healthcare (electronic medical records, telemedicine, clinical research and biobanks), HR (assessment systems, remote monitoring, ATS).