The Italian data protection authority, the Garante, opened a fact-finding exercise to investigate possible risks associated with the processing of citizens’ data by Kaspersky antivirus software. The action against Kaspersky, a Russian company, was necessary due to the war in Ukraine because several Italian and European IT security agencies identified use of the software to launch cyberattacks. Kaspersky will be required to provide the number of Italian customers, explain how personal data is processed, if data is transferred outside the EU and if data on users was requested by a third country.