Area 04 · Advice and representation
Digital law and cybersecurity
Translating digital obligations into organisational decisions, clearly defined responsibilities and contracts suited to the risks faced by a business or public body.
How we assist
Cybersecurity and leadership responsibilities
Assessing the scope of NIS2, implemented in Italy by Legislative Decree 138/2024, and other relevant obligations. Supporting the definition of roles, delegated authority, information flows and decisions by management and governing bodies. Drafting and reviewing the legal components of security policies, procedures and training programmes for those responsible.
Suppliers and the supply chain
Reviewing contracts with ICT, cloud and digital-service suppliers, focusing on service levels, security obligations, further outsourcing, oversight and operational continuity. Assessing clauses on incidents, cooperation, data return and termination. Obligations are tailored to the function of the service and the risks that are actually relevant.
Data protection and incident management
GDPR advice covering roles, privacy notices, data-processing agreements, impact assessments and data-subject requests. Legal support in handling incidents and personal-data breaches, assessing reporting and notification duties, and dealing with authorities and counterparties. Coordination between regulatory regimes ensures that obligations with different legal triggers are assessed separately.
Technology, services and artificial intelligence
Assistance in drafting contractual terms, licences, SaaS agreements, service-level agreements and data-processing agreements. Assessment of the legal implications of adopting AI tools, including liability, confidentiality, data use and work organisation. Legal safeguards are coordinated with security assessments, IT teams and technical advisers.
Illustrative example
Outsourcing an essential service to a cloud provider
A healthcare facility plans to outsource a digital service processing patient data. Assistance may cover privacy roles, data-access and transfer conditions, security commitments and incident procedures. The contract is reviewed alongside internal responsibilities, reporting to management and service-continuity requirements.
A hypothetical situation illustrating the work undertaken. It does not describe a particular client engagement.
Tools and services
Assessment of the regulatory scope; opinions for governing bodies; review of ICT contracts and data agreements; legal policies and procedures; incident-management support and training.
Contact
An initial conversation.
A clear direction.
To discuss a matter with the firm or arrange a meeting, contact our office. Appointments are available in person or by video call.