Codice in Materia di Protezione dei Dati Personali

Italy's national law implementing the GDPR with additional requirements.

Analysis

The Codice in Materia di Protezione dei Dati Personali (Italian Data Protection Code) implements the GDPR in Italy with some additional requirements:

The age of consent for data processing related to information society services is 14 years old in Italy, lower than the GDPR default of 16[1]. For children under 14, parental consent is required.

Data controllers must implement appropriate technical and organizational measures to ensure and demonstrate compliance with the GDPR and the Italian Code[2].

The Italian Data Protection Authority (Garante) has specific powers to issue guidelines and codes of conduct to help organizations comply with data protection laws[3].

Organizations must obtain explicit consent for the use of profiling cookies, while only informing users about technical cookies[4].

The Code extends data protection rights to deceased individuals, unless prohibited by law[5].

Organizations face several challenges in complying with the Italian Data Protection Code:

Navigating multiple regulations: Companies must comply with both the GDPR and the Italian Code, which can be complex and sometimes contradictory[6].

Consent management: Obtaining and managing valid consent, especially for cookies and profiling activities, is a significant challenge[7].

Data subject rights: Implementing processes to handle data subject requests, including the right to be forgotten and data portability, can be technically challenging[8].

Cross-border data transfers: Ensuring compliance with international data transfer requirements, especially after the Schrems II decision, is complex for multinational companies[9].

To implement the Italian Data Protection Code effectively:

Conduct a thorough data mapping exercise to understand what personal data you process and for what purposes[10].

Implement a robust consent management platform that can handle both GDPR and Italian-specific requirements.

Appoint a Data Protection Officer (DPO) if required, and ensure they are familiar with both GDPR and Italian data protection laws.

Regularly train employees on data protection principles and the specific requirements of the Italian Code.

Use the Garante's guidelines and FAQs as a resource for implementation guidance.

In June 2021, the Garante issued new guidelines on cookies and other tracking tools, effective from January 10, 2022.

The Garante has been actively enforcing the law, issuing significant fines for non-compliance, including a €26.5 million fine to Enel Energia in January 2022.

ePrivacy Directive: This EU directive, implemented in Italy, governs electronic communications and complements the GDPR.

NIS Directive: Italy has implemented this EU cybersecurity directive, which interacts with data protection requirements for critical infrastructure.

Telecommunications: The sector faces stringent requirements for data retention and security, as outlined in specific Garante provisions.

Healthcare: The Code includes specific provisions for processing health data, impacting how healthcare providers handle patient information.

Financial Services: Banks and financial institutions must balance data protection requirements with anti-money laundering obligations.

2025-11-28 — Analisi della Legge 23 settembre 2025 n. 132 sull’intelligenza artificiale e del suo coordinamento con il Codice in materia di protezione dei dati personali, con enfasi sull’integrazione tra GDPR, Codice Privacy e nuova disciplina AI, inclusi obblighi di supervisione umana e spiegabilità nelle decisioni automatizzate[3][8]. (source)
2025-10-30 — Commento specialistico al quadro applicativo della Legge 132/2025 che chiarisce come i principi dell’art. 4 (liceità, correttezza, trasparenza e compatibilità delle finalità) si innestano sugli artt. 5, 6 e 22 GDPR e sulle disposizioni del Codice Privacy, con impatti operativi per titolari e DPO[5]. (source)