They call me about a debt: what they can do and what they cannot

The phone rings and on the other end there is a company you have never heard of. It says you owe money to a business you had a contract with three years ago. Maybe that is true, maybe it is a mistake, maybe it is a bill you thought was settled.

At that moment you do not know two things. The first is whether that person has any right to call you. The second is how far they are allowed to go.

At the end of September, in Italy, the data protection authority, the Garante per la protezione dei dati personali, published an updated version of its debt collection guide. Set it beside the old one and something comes out that almost nobody has written about. We will get there in a moment, because it changes how the whole business should be read.

Yes, they can call you, and your consent is not required

Let us start with the question everybody asks. Can a debt collection firm handle your data without ever having asked you anything?

It can. The guide says so without hedging: the processing is lawful even without consent, because it serves the creditor’s legitimate interest in recovering what it is owed, an unpaid bill or an unpaid loan, for instance. That is Article 6(1)(f) of the GDPR.

This does not mean whoever calls can do as they please. It means consent is not the ground the match is played on. The match is played on the how.

There is also something that throws nearly everyone, and I would rather say it straight away because it saves false hope. The Garante does not decide whether that debt really exists. It writes this in capitals: it has no competence over disputes about whether the debt is owed, and for those you go to the ordinary courts or to the sector regulator, the competition authority or ARERA depending on the case. Then it adds a sentence worth reading twice: until the dispute is settled, processing data in order to recover the debt remains lawful.

So disputing the debt does not switch off the phone calls. They run on separate tracks.

The four things they cannot do

The guide gathers them under the heading “Le prassi illecite e quelle lecite”, unlawful and lawful practices. There is a single general rule, and everything else comes down from it: in order to obtain payment it is not lawful to let third parties know you have a debt, nor to apply undue pressure.

Who counts as a third party? The document lists them: family members, people you live with, work colleagues, neighbours.

Four specific prohibitions follow from that.

Visits to your home or your workplace are unlawful when they serve to let other people know you are in default, perhaps precisely in order to put you under pressure. Note how that is phrased: looking for you is not forbidden, exposing your debt to the people around you is.

Pre-recorded phone calls, the ones without a flesh-and-blood operator, are forbidden for a reason that is precise and slightly surprising: because somebody else may pick up and hear the message.

Postcards and envelopes with visible wording such as “debt collection” cannot be used. The guide also says how it should be done instead: a sealed package, no particular markings, with nothing on the outside beyond what identifies the sender.

Notices stuck up on your front door or in the shared entrance hall are unlawful, because they sit there to be read by anyone passing.

And what stays lawful? Something many people do not expect: looking for you, at your workplace too, as long as the debt is not mentioned. The document even gives the form of words to use, “we are looking for Mr X about administrative matters concerning him”.

What the papers reported and the document does not contain

Here is the part that makes this article worth reading instead of the headlines.

The strapline on the Garante’s newsletter announces an end to invasive practices “such as text messages or pre-recorded phone calls”. Half the Italian press picked that phrase up. Except that in the guide itself, twelve pages of it, the word SMS never appears once. Not a single time.

Same story for other things I have seen attributed to the document:

• social networks are not mentioned;
• there is no time of day when calling is forbidden, and no protected window;
• there is no maximum number of calls;
• home visits as such are not banned, what is banned is exposing the debt to third parties.

On repeated pressure the document uses an elastic formula, “undue pressure”, and it describes repeated chasing by telephone in the part where it recounts what the inspections found, not in the list of what is unlawful. That difference counts: a general clause leaves room for a case-by-case judgement, a numerical rule does not.

The industry association for the sector does have a code of conduct that covers hours and contacts as well, but it is voluntary self-regulation, not an act of the Garante, and I could not get hold of the text directly. So I am not reporting its contents to you.

Who answers for what

This bit is about knowing who to write to, and it is why so many people write to the wrong party and get nowhere.

The creditor, meaning the bank, the finance company, the phone or energy supplier, is the controller. The agency calling you is a processor, appointed by the creditor, and it can in turn lean on a sub-processor.

The controller has obligations that the 2026 guide has put down in black and white for the first time. It has to carry out periodic checks, documented and verifiable, on whoever works for it. And it has to pass the collector the data of debtors only, not the whole customer archive: the document says expressly that the appointed firm should be prevented from reaching straight into the creditor’s database.

The Garante has already issued fines on this ground. In a decision of July 2026 it fined a controller 50,000 euro and its processor 30,000, both for the missing checks and because a debtor who asked where his phone number had come from got no answer.

What you can actually do

1. Ask in writing where your data came from. This is the right of access under Article 15 of the GDPR. You exercise it against the controller, meaning the creditor, not against the agency, going through its data protection officer if there is one. You do not need a lawyer and there is no compulsory form: the Garante provides a template to fill in.
2. Wait a month. The reply has to come without undue delay and in any case within one month. The deadline can be extended by two months if the request is complex, but in that case they have to tell you within the first month.
3. Know in advance what you will not get. Access gives you your data, the purposes, the recipients, the origin. The guide makes clear it does not give you the right to a copy of the contract or of the document evidencing the debt. If you want those, that is a different road.
4. If you want to object, explain why. The objection under Article 21 requires grounds relating to your particular situation, with a disproportionate impact on you. The document gives an example of a well-founded objection, an account in your name but used only by somebody else, and one that does not fly: asking to be contacted only by email or only through your own lawyer.
5. If they do not reply, go to the Garante. You have two routes, both free. A complaint, reclamo, is a detailed act by which you ask the Authority to establish a breach. A report, segnalazione, is more informal and serves to bring a situation to the Garante's attention. There is a dedicated form for the complaint. I could not find any stated timescale for concluding a complaint, so I cannot tell you how long you will wait.

A historical note that saves a common mistake: the old “ricorso al Garante”, the appeal for access rights, has not existed since 25 May 2018. If you find a guide that talks about it, that guide is old.

And what if it is a scam?

I have to be honest about one point here. I looked for a notice from the Garante about fake debt collection firms used as a scam template and I did not find one: in the guide the word scam never appears, because the document is about something else.

What I did verify concerns the two mechanisms a scam of that kind would use, and both are documented by institutional sources.

The first is PEC, Italy’s certified email. On 24 September 2026 CERT-AGID flagged a campaign of fake payment reminders sent by PEC from legitimate but compromised mailboxes, with a ZIP attachment that contains not an invoice but a file that starts installing a malicious program. The sentence to hold on to is theirs: a PEC certifies that the message was transmitted, it does not guarantee that the sender’s mailbox has not been broken into.

The second is the number you see on the display. The Polizia Postale explained long ago how telephone spoofing works: with a call placed over the internet you can make a real number appear on the screen, your bank’s included, or that of a contact already in your address book. Some scammers even invite you to check on the internet that the number matches, precisely because the check comes out right.

From there, a few practical criteria. The first comes from the guide, the others are my own common sense and I give them to you as such, because I did not find an authority attributing them specifically to this scheme.

A genuine operator can identify themselves and tell you who the creditor is, because those are data they are authorised to handle, and their written communications arrive in a sealed package with an identifiable sender. There is always a paper trail. If instead they ask you to pay at once, into an IBAN in a private individual’s name or onto prepaid cards, if they refuse to put in writing who they are, if they threaten immediate consequences to push you into deciding fast, you are almost certainly talking to somebody else.

The rule that always works is a single one: end the call and ring back yourself, on a number you found on your own, never the one they gave you. I have written about this more generally in Spoofing: why the number and the sender you see prove nothing.

A figure that does not exist

Let me close with something that struck me while I was putting this article together. There is no reliable public statistic for how many people in Italy get debt collection phone calls each year. ISTAT does not publish one, the Garante does not publish one.

An industry figure circulates, 51.8 million files handed over in 2025, but it comes from the trade association of the collection firms, and above all it counts files, not people. The same person can have several files open, and a file may never produce a single phone call. Anyone turning that number into “51.8 million Italians contacted” is saying something false.

So no, I cannot tell you how much company you are in. I can tell you what you can do, which in the end is more use.