Electronic evidence: sanctions up to 1.2 million for European orders

The Government has completed the Italian alignment with the European regulation on electronic evidence: Legislative Decree no. 188 of October 8, 2026, is published in the Official Gazette of the Italian Republic, General Series no. 244 of October 20, 2026, with the reference 26G00205. The text, issued by President of the Republic Mattarella, establishes administrative pecuniary sanctions for those who violate obligations regarding European production and preservation orders for electronic evidence in criminal proceedings. The highest bracket reaches 1.2 million euros, with an alternative ceiling equal to 2 percent of the service provider’s global turnover.

The decree completes the framework initiated with Legislative Decree no. 215 of December 30, 2025, published in the Official Gazette on January 15, 2026, no. 11, and implements Regulation (EU) 2023/1543 of the European Parliament and of the Council of July 12, 2023, published in the Official Journal of the European Union on July 28, 2023, no. L 191, which governs European Production Orders (EPOC) and European Preservation Orders (EPOC-PR). Also operating in the background is Directive (EU) 2023/1544, on harmonized rules for the designation of designated establishments and legal representatives. The basis of the delegation is Article 19 of Law no. 91 of June 13, 2025, the 2024 European delegation law.

The process was lengthy: preliminary deliberation of the Council of Ministers on December 22, 2025, opinion of the Garante for the Protection of Personal Data on May 28, 2026, opinions of the competent Committees of the Chamber of Deputies and the Senate of the Republic, a new deliberation of the Council of Ministers on October 2, 2026, and issuance on October 8, 2026. The decree bears the signatures of Meloni, Foti, Nordio, Piantedosi, Tajani, Crosetto, and Giorgetti, with the visa of Nordio as Minister of Justice.

Six sanction brackets, from 10,000 to 1.2 million

Article 3 establishes a scale proportionate to the type of obligation violated:

• from 25,000 to 100,000 euros for the transmission obligations of Article 10, paragraphs 2, 3, and 4, of the regulation;
• from 10,000 to 50,000 euros for the information and communication obligations of Article 10, paragraphs 5, 6, 7, and 8;
• from 100,000 to 1,000,000 euros for the preservation obligations of Article 11, paragraphs 1 and 2;
• from 10,000 to 50,000 euros for the information and communication obligations of Article 11, paragraphs 4, 5, 6, and 7;
• from 500,000 to 1,000,000 euros for the duties of Article 13, paragraph 4;
• from 600,000 to 1,200,000 euros for non-compliance with Article 16, paragraph 10.

The ceiling of 2 percent of global turnover

When two or more aggravating circumstances concur, or the act is of particular gravity, and the conduct has definitively prevented the acquisition of the data subject to the production order or has caused the definitive loss of the data subject to the preservation order, a penalty of up to 2 percent of the service provider’s worldwide turnover in the last closed financial year shall be applied, if this exceeds the maximum of the bracket. The quantification takes into account the nature, gravity, and duration of the violation, whether it was intentional or negligent, previous violations, financial and economic conditions, cooperation with the authorities, activities carried out to eliminate or mitigate the consequences, the nature and size of the service provider or the designated establishment, and the degree of fault.

Who imposes the penalty and how to contest it

Penalties are applied by the judge for preliminary investigations identified by Article 6, paragraph 1, of Legislative Decree no. 215 of December 30, 2025, ex officio or upon request of the Public Prosecutor when the latter is the executing authority. The procedure provides for:

• specific contestation of the fact, with 30 days to present defense briefs and documents;
• notification of the contestation within 90 days from the expiry of the deadline set by the executing authority;
• a reasoned order with an injunction for payment, or a dismissal order;
• payment within 30 days of notification, with payment to the fund under Article 61, paragraph 23, of Decree-Law no. 112 of June 25, 2008;
• opposition within 30 days before the court of the capital of the district in which the designated establishment is located or the legal representative resides, with a single-judge decision and appeal to the Court of Cassation only for violation of the law.

Appeals against orders and financial coverage

Article 4 recognizes the right of the person whose data has been acquired to appeal against the European production order, including to contest its legitimacy, necessity, and proportionality: if the order is issued or validated by the judge, Articles 324 and 325 of the code of criminal procedure apply; if it is issued or validated by the public prosecutor, the appeal must be submitted within 10 days to the judge for preliminary investigations, who decides in accordance with Article 127 of the code of criminal procedure. Article 2 mandates that the notification to the data subject occurs according to Article 14 of Legislative Decree no. 51 of May 18, 2018, and contains notice of the right of appeal.

For the implementation of Chapter V of the regulation, Article 5 authorizes an expenditure of 1,865,412 euros for 2026 and 45,840 euros annually starting from 2027, partially covered by the fund for the transposition of European legislation. Article 6 closes with the financial invariance clause for the remaining provisions.

The impact is direct on three categories: magistrates and lawyers, who must deal with disputes and appeals within tight timeframes, and digital service providers and designated facilities, exposed to sanctions that can exceed one million euros and, in the most serious cases, a percentage of global turnover.

Source: Official Gazette of the Italian Republic, General Series no. 244 of October 20, 2026 — Legislative Decree October 8, 2026, no. 188 (26G00205).