Dati e privacy: Italia (2026)
Italy has a comprehensive, in-force personal data protection regime built on the directly applicable GDPR together with the national Privacy Code (Legislative Decree 196/2003, substantially rewritten by Legislative Decree 101/2018 to align with the GDPR). The Garante per la protezione dei dati personali — an independent authority established in 1997 — is the GDPR Article 51 supervisory authority and is one of the most active data-protection regulators in the EU, with powers extending to administrative fines up to €20 million or 4% of worldwide turnover and additional criminal penalties for the most serious infringements.
Struttura primaria
EU General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) directly applicable, as supplemented nationally by the Italian Personal Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018). Supervised by the Garante per la protezione dei dati personali.
Punti chiave
Primary legal framework
GDPR (Regulation (EU) 2016/679) applies directly, complemented by the Italian Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018, which harmonised national rules with the GDPR and governs areas left to Member State discretion (public administration, health data, scientific research, criminal sanctions).
Supervisory authority
The Garante per la protezione dei dati personali, headquartered in Rome, is Italy's independent supervisory authority under GDPR Article 51. It is a collegiate body of four members elected by Parliament for a seven-year term and enforces both the GDPR and the e-Privacy Directive (2002/58/EC) in Italy.
Core obligations and data-subject rights
Controllers and processors must satisfy the GDPR's full obligation set — lawful basis, transparency, data-minimisation, security, breach notification within 72 hours, DPIAs for high-risk processing, DPO appointment where required, and records of processing. Individuals enjoy the GDPR rights of access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making.
Italian-specific features
The Privacy Code sets the digital-consent age for information society services at 14 (Article 2-quinquies), preserves specific rules on employment, health, judicial and public-sector processing, and — unusually within the EU — maintains criminal penalties alongside GDPR administrative fines for the most serious violations.
Active enforcement
The Garante is one of the EU's most active DPAs, issuing hundreds of decisions and multi-million-euro fines. Recent examples include a combined €12.5 million fine against Poste Italiane/Postepay for unlawful app tracking (April 2026) and €9.5 million against TIM S.p.A. for unlawful telemarketing (July 2026); maximum GDPR fines reach €20 million or 4% of global turnover.
Interaction with newer EU and national frameworks
Italy's data-protection regime now operates alongside additional EU rules (NIS2, Digital Services Act, Data Act, AI Act) and the Italian AI law (Law No. 132/2025), with the Garante retaining competence over personal-data aspects of AI-system processing in Italy.
La presente pagina è una traduzione fornita a titolo informativo; la versione inglese è quella ufficiale e non costituisce un parere legale.