Regulatory advisory and high-level strategic support provided to a leading financial institution in the context of interactions and formal proceedings with the Italian Data Protection Authority (Garante per la protezione dei dati personali), concerning an alleged unlawful processing of personal data related to the absence of explicit consent. Design and implementation of an alternative compliance strategy grounded in the legitimate interest legal basis, including a refined legal qualification of the processing activities, a balancing test aligned with GDPR standards, and a risk-based governance approach aimed at ensuring regulatory robustness while preserving operational continuity.