Italy fines US data broker Lusha

In late July 2026 Italy’s data‑protection authority, the Garante, imposed a €2 million administrative fine on U.S.‑based data‑broker Lusha Systems Inc. The regulator ordered the company to halt all processing of personal data of individuals located in Italy and to erase any such data already held. The decision cited breaches of core GDPR principles, including unlawful processing, lack of a valid legal basis, insufficient transparency and failure to observe data‑minimisation.

A follow‑up report in early August clarified that the fine, representing 10 % of the applicable ceiling, was adopted on 14 July and announced on 27 July. Lusha was given 60 days to demonstrate deletion of Italian‑territory data, and the fine could be reduced by half if the company appealed within the prescribed window. The authority emphasized that, despite having no EU establishment, Lusha’s activities constitute monitoring of persons in the Union and therefore fall under GDPR jurisdiction.