BonelliErede‘s data protection and privacy offering covers notification applications, investigations and proceedings before Italy’s personal data protection authorities, and the data and privacy protection side to outsourcing agreements and joint ventures. Other areas are IoT-related data exploitation, projects involving data transfers abroad, and analysing data flows and compliance programmes. Tommaso Faelli leads the digital innovation group. Ivan Rotunno and Giulia Rivarola di Roccella specialise in privacy law, cybersecurity and data innovation; Anna La Mura advises on privacy and data protection; and Giulia Tenaglia assists with projects involving data management.

Part of the firm’s IP and tech department, DLA Piper’s Milan-based data privacy and protection group has notable expertise in data-driven projects, managing cyberattacks, and navigating privacy-related disputes. It recently also assisted several major clients with the establishment of AI compliance programmes. Heading up the group, Giulio Coraggio‘s notable track record includes advising cryptocurrency providers on the exploitation of blockchain-related data; Giulia Zappaterra is a privacy, data protection and cybersecurity expert; and Cristina Criscuoli specialises in privacy and data protection matters in the life sciences and financial sectors.

The data privacy and cybersecurity team at Hogan Lovells International LLP is sought out by Italian and international clients to assist with anti-fraud data processing, data breach responses, and privacy in the fintech, insurance and finance sectors. Other notable areas include data sharing with public administrations, data assessments, DPO assistance, e-privacy, GDPR compliance, international data transfers, and privacy and data security-related investigations. Heading the group, Massimiliano Masnada is a highly-rated privacy and data protection specialist, while Giulia Mariuz‘s experience covers data protection impact assessments and data breaches.

Working across the firm’s Milan, Rome and Bologna offices, ICT Legal Consulting‘s sizeable privacy and data protection practice is routinely mandated by renowned brands from the fashion, banking, finance, and automotive sectors. The group is co-led by Paolo Balboni, a privacy and cybersecurity specialist who acts as a data protection officer for multinational companies, and the ‘very thorough’ Luca Bolognini. Other key practitioners are Nicola Franchetto, Raffaella Cesareo, and Sara Pecoraro, who all advise on personal data protection matters.

According to clients, PANETTA Studio Legale | PANETTA Law Firm fields the ‘number one data privacy, cyber and AI team in Italy’. Acting for medium-sized and large multinational companies, the firm’s privacy and data protection practice focuses on the telecoms, internet and renewable energy sectors. Founder Rocco Panetta is a renowned privacy and data protection specialist; Lorenzo Cristofaro regularly acts as a DPO; and Tommaso Mauro is an expert in personal data protection and big data. Another name to note is Federico Sartore, who has ‘a laser focus on achieving commercial outcomes’.

Portolano Cavallo‘s data privacy and protection team acts in high-stakes disputes and breaches, as well as advising on launches of new initiatives to exploit data, and M&A and employment-related data protection issues. Many of the firm’s current clients are from emerging sectors such as life sciences, healthcare, telecoms, and e-commerce. Internet and data protection specialist Laura Liguori leads the group from Rome. In Milan, Giulio Novellini‘s workload covers GDPR compliance programmes, data breach preparedness, and incident responses, and Eleonora Curreli‘s wide-ranging practice covers privacy, cyber security, and data protection.

The data protection and cybersecurity practice at Chiomenti is experienced in GDPR matters, the Italian Data Privacy Code, cyber incident management, and major data breaches and transfers. Heading the group, Pierluigi Perri‘s track record includes assisting with GDPR-related migration, defining corporate data strategy, and acting as a data protection officer for large entities. The team further showcases Marilena Hyeraci, an expert in data protection issues, responding to suspected security breaches, and personal data disclosures to Italy’s authorities, and Ersilia Lazzara, who assists with personal data processing and data breaches.

The privacy team at Gianni & Origoni covers investigations, compliance, drafting specific data protection and privacy agreements, and structuring ad hoc data protection compliance systems. The group also assists with data protection auditing, in addition to representing clients facing enforcement actions conducted by the Italian Data Protection Authority. The department is co-led by privacy and cybersecurity law expert Stefano Mele; Daniele Vecchi, an adviser on commercial transaction-related data protection issues; and Melissa Marchese, who acts for domestic and multinational companies on ordinary and extraordinary data protection management, including IT aspects.

The broad practice at Orsingher Ortu – Avvocati Associati ranges from drafting corporate policies, data processing agreements and information notices, to providing legal support to data protection officers. The group also covers cybersecurity matters, data breach management, proceedings before ordinary courts and the Italian Data Protection Authority, outsourcing-related data protection issues and compliance with data protection legislation. Heading up the team, Fabrizio Sanna is a data privacy and protection expert; Marta Minonne assists internet and communications sector operators with data protection matters; and Domenico Colella is an outsourcing project specialist.

Fielding consumer, telecoms, pharma and medical sector experts, ADVANT Nctm advises on compliance with personal data protection regulations, information notices for personal data processing, data processing agreements and the transfer of data outside the EU. Paolo Gallarati heads the data protection practice group, which includes ‘very efficient lawyer’ Giulio Uras, who advises on personal data protection.

Acting for Italian and multinational companies, including fashion companies, LCA Studio Legale‘s 11-strong team covers day-to-day data-related advice, privacy by design support, and assistance during cyber incidents. It also advises on data transfers, data-sharing agreements and management, the introduction of new data-driven technologies and services, and interactions with regulators. The department is co-led by Gianluca De Cristofaro, who has notable data protection experience, and the ‘extraordinary’ Giulio Vecchi. Elsa Gentile joined the team from ADVANT Nctm in February 2025.

Legance - Avvocati Associati‘s team is particularly experienced in GDPR, the Italian Privacy Act, cybersecurity legislation, the management and implementation of data protection schemes, AI, and the implications of the Data Act and the Data Governance Act. The Rome-based team is headed up by Andrea Fedi, whose experience covers compliance, privacy, and anti-bribery. Providing key support, the ‘trustworthy and skilled’ Lucio Scudiero is a data law and cybersecurity specialist.

LEXIA acts for IT service providers, software houses, content creators, and tech and fintech platforms on DPO activities, privacy governance structures, GDPR compliance, data transfers, and data breach prevention and incident response. Promoted to partner in March 2024, Aurora Agostini advises on day-to-day GDPR compliance, data breaches, big data projects, international data transfers, data processing agreements, and M&A transactions involving data protection issues. Giulietta Minucci is a blockchain expert.

Ughi E Nunziante advises Italian and multinational companies on GDPR, data protection audits, and compliance. The team also assists during inspections, as well as proceedings brought by the Authority for the Protection of Personal Data. Its sector expertise includes healthcare, tech, fashion, insurance, and non-profit. Massimiliano Pappalardo is ‘a reliable local counsel for all privacy and data protection matters in Italy’, while Agostino Clemente also has notable data protection experience.

Bird & Bird‘s team regularly works with the firm’s international network in relation to high-profile clients that collect and transfer large quantities of sensitive data. The group is co-led by Adriano D’Ottavio, who is experienced in managing data breaches and security incidents, and data protection and IT specialist Debora Stella.

Covering the gamut of data privacy work, CMS‘ practice ranges from compliance and cyber breach responses to defence mandates involving regulators and class actions. Heading up the department from Rome, Italo de Feo advises on data protection, outsourcing, IT, internet and telecoms matters, as well as broadcasting and media regulations.

Grimaldi Alliance is mandated by public and private companies, as well as private equity funds, on privacy and data protection matters. Working across the firm’s Milan and London offices, Francesco Conti heads up the privacy and data protection offering. Providing key support from Rome, Laura Bellicini advises on privacy issues.

The regulatory, compliance and data protection practice at Pirola Pennuto Zei & Associati assists with the implementation of data protection safeguards. The Milan-based team is led by Roberta Di Vieto, who has extensive experience in regulatory, compliance and data protection matters. Providing key support, Mattia Salerno advises on data protection-related compliance.

Withers Studio Legale‘s team advises on cross-border GDPR compliance programmes, privacy and cybersecurity training, due diligence for existing programmes, and privacy litigation and auditing. Leading the IP, tech, and privacy group, Jacopo Liguori has ‘great expertise in data protection and privacy’. Tiziana Campigli is another experienced practitioner.