Codice in Materia di Protezione dei Dati Personali

· About Codice in Materia di Protezione dei Dati Personali

Key Takeaways

  • The Codice in materia di protezione dei dati personali is Italy’s national privacy code, enacted as d.lgs. 196/2003 and subsequently aligned to the GDPR by d.lgs. 101/2018; the Garante per la protezione dei dati personali is the competent supervisory authority.[1][3][5]
  • It applies to controllers and processors operating in Italy and, where Italian law supplies national derogations or sectoral rules, to processing that is otherwise governed primarily by the GDPR and the Italian code.[1][3][4]
  • The code remains in force in 2026, and the official consolidated text on the Garante’s site is the safest reference point because it reflects amendments and cross-references to the GDPR framework.[1][8][15]
  • Compliance failures can trigger administrative sanctions under the GDPR plus national measures and orders from the Garante; the Italian code also contains sector-specific offences and special procedural rules.[3][4][8]
  • The law matters most where Italy has used GDPR-opening clauses for employment, journalism, health, scientific research, and public-sector processing, so multinational groups need an Italy-specific gap analysis.[1][4][8]
  • No 2025–2026 overhaul replacing the code is indicated in the official sources reviewed; instead, the current regime is the consolidated code plus Garante decisions and sectoral provisions updated through 2026.[1][7][8][12]

What It Is

The Codice in materia di protezione dei dati personali is Italy’s national privacy statute, originally adopted by d.lgs. 30 giugno 2003, n. 196 and later amended to align with the GDPR by d.lgs. 10 agosto 2018, n. 101.[3][5][8] The Garante per la protezione dei dati personali enforces the code and is expressly identified as Italy’s data-protection supervisory authority for GDPR purposes.[3][4]

The key dates are these: the code was adopted on 30 June 2003; the GDPR-alignment decree d.lgs. 101/2018 entered into force on 19 September 2018; and the Garante continues to publish the texto coordinato as the operative consolidated version in 2026.[5][8][15] The official materials reviewed do not show a later replacement statute or a delayed entry into force for the current code; rather, they show ongoing 2025–2026 application through updated provvedimenti and the consolidated text.[1][10][12]

The code sits alongside the GDPR, not instead of it: it fills national derogations, sectoral rules, and procedural details where the GDPR permits member-state choices.[3][4][8]

Who Must Comply

The code applies to data controllers and processors subject to Italian jurisdiction, including public authorities and private entities carrying out personal-data processing in Italy or under Italian law.[3][4][8] It is especially relevant where Italian law adds rules to GDPR baseline obligations, such as for employment, health data, archives, journalism, and research.[1][4][8]

The regime has extraterritorial effect to the extent the GDPR itself reaches entities outside the EU that target people in the Union and process their data in connection with EU-facing activities; in practice, those entities must also respect Italian national rules where they operate in the Italian market or rely on Italian law bases and derogations.[3][4] There is no general blanket exemption for non-EU companies simply because they are outside Italy if their processing falls within the GDPR’s territorial scope and Italian rules are engaged.[3][4]

Public-sector bodies, courts acting in a judicial capacity, and certain journalistic or archival processing enjoy special treatment, but those are carve-outs and tailored rules, not a general exemption from privacy compliance.[1][4][8] The official consolidated text and the Garante’s sector pages should be checked for the exact carve-out applicable to a given processing activity.[1][7][15]

Core Requirements

  1. Lawful processing and legal basis — Controllers must have a valid GDPR legal basis, and where Italian law requires additional authorization, sector-specific law, or a public-interest basis, that national rule must also be satisfied.[3][4][8]
  2. Transparency and information notices — Data subjects must receive clear privacy information, with Italian-language and sector-specific presentation requirements often used in practice for local compliance.[1][4][8]
  3. Data subject rights handling — Controllers must process access, rectification, erasure, restriction, portability, and objection requests within GDPR timelines, while respecting Italian exceptions for journalism, archives, research, and public interests.[3][4][8]
  4. Security and accountability — Controllers and processors must implement appropriate technical and organizational measures, maintain accountability records, and align operational controls to the risk of the processing.[3][4][8]
  5. Appointment and governance — Where required, organizations must appoint processors, sub-processors, and the DPO under GDPR rules, and they should map Italian-specific internal governance duties imposed by sectoral provisions or Garante decisions.[3][4][10]
  6. Special-category data controls — Processing health data, biometric data, genetic data, and other special categories requires heightened safeguards and, in some cases, specific Italian authorization or limitations.[1][4][8]
  7. Breach response and cooperation — Controllers must preserve evidence, assess incidents, notify where GDPR thresholds are met, and cooperate with the Garante in investigations or corrective procedures.[3][4][12]
  8. Local sector rules — Employers, publishers, public bodies, and research entities must test their processing against Italian derogations and the Garante’s guidance, because the code often supplements the GDPR rather than repeating it.[1][4][8]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Original adoption | 30 June 2003 | Codice in materia di protezione dei dati personali enacted as d.lgs. 196/2003.[5][8] | | GDPR-alignment decree | 10 August 2018 | d.lgs. 101/2018 amended the code to align it with Regulation (EU) 2016/679.[3][5] | | Entry into force of alignment decree | 19 September 2018 | The aligned code became operative as the basis for Italy’s post-GDPR privacy framework.[5] | | Consolidated-text regime | ongoing through 2026 | Garante publishes the consolidated text and updated decisions as the working legal reference.[1][8][15] |

Maximum fines and sanctions depend on the underlying breach. For GDPR-type infringements, administrative fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher, and Italian law also allows corrective orders, limitations, suspensions, and in some cases criminal or quasi-criminal consequences under the national code.[3][4][8] The Garante’s decisions in 2025–2026 confirm active enforcement through fines, warnings, and processing bans rather than any suspension of the regime.[10][12]

How to Comply

  1. Map the processing inventory — Identify all Italian and Italy-facing processing activities, then classify which are governed only by the GDPR and which also trigger Italian derogations or sector rules.[1][4][8]
  2. Build a legal-basis matrix — Document the GDPR basis, the Italian-law basis, and the specific code/article or sector instrument relied on for each processing purpose.[3][4][8]
  3. Harden transparency and notices — Standardize notices for employees, customers, and website users, and localize them for Italian legal terminology and Garante expectations.[1][4]
  4. Operationalize rights handling — Use ticketing, identity-verification, and escalation workflows to meet response deadlines and to detect when an Italian exception applies.[3][4][8]
  5. Run DPIAs and risk controls — Use ISO 27001 controls for security governance, NIST CSF 2.0 for incident response and risk management, and ISO 42001 where AI systems are used in profiling, HR, or automated decision support.[3][4][8]
  6. Manage vendors and cross-border flows — Update processor terms, intra-group agreements, and transfer assessments so that Italian requirements are reflected in contractual and technical controls.[3][4][8]
  7. Train local teams and reviewers — Train HR, marketing, legal, and security teams on Italian carve-outs for employment, direct marketing, journalism, and health data.[1][4][8]
  8. Track Garante decisions — Monitor new provvedimenti and guidance because the Garante’s interpretive decisions are often the practical source of operating expectations in Italy.[1][10][12]

Related Regulations

GDPR (Regulation (EU) 2016/679) is the primary framework, and the Italian code mainly supplies national derogations and implementation details rather than replacing it.[3][4][8] Directive 2002/58/EC (ePrivacy) overlaps on cookies, electronic communications, and marketing, so businesses must check both regimes for website and telecom-related processing.[1][4] Italian Workers’ Statute and employment-law rules interact with workplace monitoring and employee-data processing, often narrowing what employers may do under privacy law.[1][4][8] Directive (EU) 2016/680 can conflict with the general code where law-enforcement processing is involved, because police and judicial data have a separate regime.[4][8] AI Act is increasingly relevant where automated decision-making or biometric processing is used, but it does not displace privacy-law obligations and may add governance duties.[8]

FAQ

Does the Italian Privacy Code apply to companies outside Italy?

Yes, if the company’s processing falls within the GDPR’s territorial scope and Italian national rules are engaged for the activity at issue.[3][4] The practical trigger is not corporate nationality but whether the processing affects people in Italy or is governed by Italian sector rules.

Does the code still apply after the GDPR?

Yes. The code remains in force as Italy’s national supplement to the GDPR, especially for areas where EU law allows national choices.[1][3][8] The Garante’s consolidated text confirms that the post-2018 framework is still the operative regime in 2026.[1][8][15]

Are there special rules for employee monitoring?

Yes. Italian privacy law is more restrictive in the employment context than a generic GDPR-only reading would suggest, especially for monitoring tools and workplace controls.[1][4][8] Employers should check the code, labor law, and Garante guidance before deploying surveillance or productivity systems.

What fines can the Garante impose?

For GDPR-level breaches, the maximum administrative fine can reach €20 million or 4% of worldwide annual turnover, whichever is higher.[3][4] The Garante can also issue orders to stop processing, limit specific activities, or require remedial measures.[4][12]

Did Italy replace the Privacy Code in 2025 or 2026?

No replacement statute appears in the official materials reviewed; the current regime remains the consolidated code as amended and enforced through 2026.[1][8][12] 2025–2026 materials show continued decisions and enforcement, not a delayed overhaul or repeal.[10][12]

Sources

Put it into practice

More compliance guides