News · Criminal law · – 6 November 2026
Legislative Decree no. 188 of 8 October 2026 completes the alignment of Italian law with Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence. It introduces administrative fines for service providers that fail to execute orders, up to 2 per cent of worldwide turnover in the most serious cases, and gives the person whose data have been obtained a remedy against the production order.
The framework. The decree supplements Legislative Decree no. 215 of 30 December 2025, which designated the competent authorities and procedures. Published in Gazzetta Ufficiale no. 244 of 20 October 2026 and containing no clause on its entry into force, it has been in force since 4 November 2026, after the ordinary fifteen-day period following publication. Article 3 sets graduated fines: EUR 25,000 to 100,000 for the transmission obligations under Article 10(2), (3) and (4) of the Regulation; EUR 10,000 to 50,000 for the information and notification obligations under Article 10(5), (6), (7) and (8) and Article 11(4), (5), (6) and (7); EUR 100,000 to 1,000,000 for the preservation obligations under Article 11(1) and (2); EUR 500,000 to 1,000,000 for the duties under Article 13(4); EUR 600,000 to 1,200,000 for non-compliance under Article 16(10). Where two or more of the factors relevant to the amount of the fine are present, or the infringement is particularly serious, and the conduct has permanently prevented the data covered by a production order from being obtained or has caused the permanent loss of the data covered by a preservation order, the fine may reach 2 per cent of worldwide turnover in the last financial year closed before the infringement was established, where that amount exceeds the maximum.
Why it matters. For designated establishments and legal representatives of service providers, the amount of the fine takes into account cooperation with the authorities, remedial action and the degree of fault, assessed against the technical and organisational measures in place. These are administrative fines, with Law 689/1981 applying on a residual basis, but the approach mirrors that of the organisational models of corporate criminal law: a documented internal control framework is the first argument available to the defence. On the defence side, Article 4 allows the lawfulness, necessity and proportionality of the order to be challenged. An order issued or validated by a judge is challenged under Article 324 of the Code of Criminal Procedure, within ten days of its execution or of becoming aware of it, with Article 325 applying in so far as compatible; an order issued or validated by the public prosecutor is challenged by an application to the giudice per le indagini preliminari (preliminary investigations judge) within ten days of becoming aware that the data were obtained, and the judge decides under Article 127 of the Code. In both cases an appeal to the Court of Cassation lies only for breach of law (violazione di legge). In our view the date on which the person became aware will often be disputed: informing the data subject, which must include notice of the right to challenge the order, is governed by Article 14 of Legislative Decree 51/2018, which allows that information to be delayed, restricted or withheld where provided by law.
In practice. Fines are imposed by the preliminary investigations judge of the tribunale (first-instance court) at the seat of the court of appeal district in which the designated establishment or the legal representative is established or resides, of the judge’s own motion or, where the procuratore della Repubblica (public prosecutor) at that court is the enforcing authority, at the prosecutor’s request. Service of the notice of infringement must be ordered within ninety days of the expiry of the time limit set by the enforcing authority or of the date on which information about the infringement was received; the person concerned has thirty days to file written submissions and documents. The proceedings end with an ordinanza di ingiunzione (order to pay) or an order closing the case (archiviazione). Payment is due within thirty days of service of the order; an objection must be lodged with the tribunale at the seat of the district, on pain of inadmissibility, within thirty days of service of the order; the court sits as a single judge and rules by a judgment that may be appealed to the Court of Cassation only for breach of law. On the role of defence counsel, see when a criminal lawyer is needed.
Frequently asked questions.
Since when has Legislative Decree 188/2026 been in force?
The decree has no clause of its own on entry into force: published in the Gazzetta Ufficiale of 20 October 2026, it has been in force since 4 November 2026, after the ordinary fifteen-day period.
Who can challenge a European Production Order, and within what time limit?
The person whose data have been obtained, within ten days. If the order was issued or validated by a judge, Article 324 of the Code of Criminal Procedure applies and time runs from its execution or from becoming aware of it; if it was issued or validated by the public prosecutor, the application is made to the preliminary investigations judge and time runs from becoming aware that the data were obtained. In both cases an appeal to the Court of Cassation lies only for breach of law.
How can a fine imposed on a service provider be contested?
By filing written submissions within thirty days of the notice of infringement and, against the order to pay, by lodging an objection with the tribunale at the seat of the district within thirty days of service, on pain of inadmissibility.
Summary note by the CommercialistiAvvocati network, based on specialised legal and practice sources. The text does not reproduce original contributions and does not constitute professional advice.