Garante per la protezione dei dati personali (Italy) - 542/2026
Italy's Garante fines Lusha Systems Inc. €2M for GDPR violations related to professional contact data.
The Italian Data Protection Authority (Garante) has fined Lusha Systems Inc. €2,000,000 for processing professional contact data without a valid legal basis. The company, which operates a B2B contact-data platform, was found to be in breach of transparency and data minimisation requirements. The Garante also cited Lusha's failure to implement privacy-by-design measures to exclude public officials' data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Lusha Systems Inc.?
Get an email when a new story names Lusha Systems Inc., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonLusha Systems Inc. was fined €2,000,000 by Italy's Garante for collecting and processing professional contact data without establishing a valid legal basis under GDPR, violating core principles of transparency and data minimisation. The company failed to implement privacy-by-design measures, including safeguards to exclude data relating to public officials. This case highlights that B2B data platforms are not exempt from GDPR obligations simply because they handle professional rather than personal contact details. The ruling underscores the regulator's expectation that organisations proactively embed data protection principles into their products from inception, not as an afterthought.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.