What does a company risk with a website that is not GDPR-compliant?

The Italian Data Protection Authority (Garante per la protezione dei dati personali) is the independent Italian authority that oversees the application of privacy law, examines complaints and publishes guidance. For companies in Como, Brianza and Milan it is an institutional reference point; how to read its guidance in your case is for your legal advisor.

The GDPR is the European regulation that sets out how to process people's personal data, and it applies to websites too. For a company in Como or Brianza it means informing users, collecting only what is needed and protecting the data. For your specific case, check with your legal advisor or DPO.

A company website processes personal data collected from contact forms, newsletters, private areas, job applications and statistics tools. For companies in Cantù and Como the exact list depends on the tools active on the site: we map them, while the legal assessment is up to your legal advisor or DPO.

Accountability under the GDPR is the principle of responsibility: whoever processes personal data must be able to demonstrate how they handle it. For a company website in Como or Brianza it means documenting tools, consents and choices. How to apply it in your case is for you to assess with your legal advisor or DPO.

The data controller is, in general terms, the party that decides why and how the data collected by the website is processed: normally the company that runs it. For businesses in Como and Milan, who it is in a specific case should be assessed with your legal advisor or DPO.