Italy. Comprehensive data protection. Act
Codice PrivacyPersonal Data Protection Code, Legislative Decree No. 196 of 30 June 2003 (Codice in materia di protezione dei dati personali)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Italy's Privacy Code, as amended in 2018, supplements the GDPR, sets national legal bases for public tasks and contains the ePrivacy rules in Title X. It includes criminal offences and research rules.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 14. Criminal offences for unlawful processing and large-scale data acquisition (Arts 167-167-bis); employee monitoring also governed by Workers' Statute Art 4; post-mortem rights; Garante can issue general measures and codes of conduct.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; criminal penalties
§3Dates
- Key dates
- Adopted
- In force
- Adapted to GDPR by D.Lgs. 101/2018 (in force 2018-09-19); further amended 2021 (D.L. 139/2021)
§4Text and authority
- Text
- Authoritative text normattiva.it
- English text garanteprivacy.it
- Authority
- Garante per la protezione dei dati personali
§5Where it applies
- Domestic law of
- Italy
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.