Data protection & privacy law in Italy (2026)

Legal framework

EU General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) directly applicable, as supplemented nationally by the Italian Personal Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018). Supervised by the Garante per la protezione dei dati personali.

GDPR & data protection in Italy

In Italy, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Garante per la protezione dei dati personali.

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Garante per la protezione dei dati personali

Applies to

any organisation processing the personal data of people in Italy, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Italy supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Italy

1. 01Primary legal framework

   GDPR (Regulation (EU) 2016/679) applies directly, complemented by the Italian Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018, which harmonised national rules with the GDPR and governs areas left to Member State discretion (public administration, health data, scientific research, criminal sanctions).

   garanteprivacy.it whitecase.com

2. 02Supervisory authority

   The Garante per la protezione dei dati personali, headquartered in Rome, is Italy's independent supervisory authority under GDPR Article 51. It is a collegiate body of four members elected by Parliament for a seven-year term and enforces both the GDPR and the e-Privacy Directive (2002/58/EC) in Italy.

   garanteprivacy.it coe.int

3. 03Core obligations and data-subject rights

   Controllers and processors must satisfy the GDPR's full obligation set — lawful basis, transparency, data-minimisation, security, breach notification within 72 hours, DPIAs for high-risk processing, DPO appointment where required, and records of processing. Individuals enjoy the GDPR rights of access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making.

   garanteprivacy.it dlapiperdataprotection.com

4. 04Italian-specific features

   The Privacy Code sets the digital-consent age for information society services at 14 (Article 2-quinquies), preserves specific rules on employment, health, judicial and public-sector processing, and — unusually within the EU — maintains criminal penalties alongside GDPR administrative fines for the most serious violations.

   getsolution.it cliffordchance.com

5. 05Active enforcement

   The Garante is one of the EU's most active DPAs, issuing hundreds of decisions and multi-million-euro fines. Recent examples include a combined €12.5 million fine against Poste Italiane/Postepay for unlawful app tracking (April 2026) and €9.5 million against TIM S.p.A. for unlawful telemarketing (July 2026); maximum GDPR fines reach €20 million or 4% of global turnover.

   gdprfine.com panatolawfirm.com

6. 06Interaction with newer EU and national frameworks

   Italy's data-protection regime now operates alongside additional EU rules (NIS2, Digital Services Act, Data Act, AI Act) and the Italian AI law (Law No. 132/2025), with the Garante retaining competence over personal-data aspects of AI-system processing in Italy.

   recordinglaw.com garanteprivacy.it

GDPR in Italy: FAQ

Timeline of decisions

1. 1 Jul 2025Enforcement · official
   Garante fines Autostrade per l'Italia €420,000 over employee data

   The Garante fined the motorway operator €420,000 for using an employee's private Facebook, Messenger and WhatsApp content in disciplinary proceedings, breaching lawfulness, purpose-limitation and minimisation principles. It signals strict enforcement of workplace privacy limits.

   EDPB

2. 19 May 2025Enforcement · official
   Garante fines Replika maker Luka Inc. €5 million

   The Garante imposed a €5M fine on Luka Inc. for lacking a legal basis, transparency and any age-verification for its AI companion chatbot, and opened a fresh probe into its generative-AI training. It cemented Italy's role as a leading AI-privacy enforcer.

   EDPB

3. 30 Jan 2025Enforcement
   Garante blocks Chinese AI chatbot DeepSeek

   The Italian Data Protection Authority (Garante) ordered an immediate limitation on processing of Italian users' data by DeepSeek over transparency, legal-basis and cross-border (China) data-storage concerns, effectively blocking the service pending its inquiry. It underscored Italy's aggressive posture on data and AI-related security risks.

   The Record

4. 30 Jan 2025Decision
   Garante blocks DeepSeek AI for Italian users

   The Garante imposed an urgent, definitive limitation on processing Italian users' data by China's DeepSeek after finding its responses inadequate and noting data was stored in China contrary to GDPR safeguards. It was the first major EU action against the Chinese model.

   Bird & Bird

5. 20 Dec 2024Enforcement
   Garante fines OpenAI €15 million over ChatGPT

   The Garante concluded its ChatGPT investigation, fining OpenAI €15 million for GDPR breaches including unlawful processing and inadequate transparency/age-verification. It is one of Europe's most significant enforcement actions against a generative-AI provider.

   IAPP

6. 20 Dec 2024Enforcement · official
   Garante fines OpenAI €15 million over ChatGPT

   Closing its ChatGPT inquiry, the Garante fined OpenAI €15M for processing training data without an adequate legal basis, transparency failures, weak age verification and an unreported 2023 breach, and ordered a six-month public information campaign. It was the first GDPR penalty against a generative-AI provider.

   Garante per la protezione dei dati personali

7. 28 Apr 2023Decision · official
   ChatGPT reinstated in Italy after compliance measures

   OpenAI restored ChatGPT access in Italy after adopting transparency notices, an opt-out for training, age-gating and other measures demanded by the Garante. It set an early template for EU-wide AI compliance expectations.

   Garante per la protezione dei dati personali

8. 31 Mar 2023Decision · official
   Garante orders temporary stop of ChatGPT

   Italy became the first country to suspend ChatGPT, ordering OpenAI to halt processing of Italian users' data over the lack of a legal basis for training, missing transparency and absent age verification. It opened the global wave of AI data-protection scrutiny.

   Garante per la protezione dei dati personali

9. 2 Feb 2023Decision
   Garante blocks AI chatbot Replika

   The Garante issued an urgent order halting Replika's processing of Italian users' data, citing risks to minors and vulnerable people, no effective age checks and an invalid contract-based legal basis. It was an early marker of AI-specific enforcement.

   Portolano Cavallo

10. 19 Sept 2018Law
    Legislative Decree 101/2018 harmonizes Italian law with GDPR

    The decree amended the 2003 Privacy Code, repealing provisions incompatible with the GDPR and legislating in areas left to member states (public sector, health data, research, criminal sanctions, age-14 consent for online services). It defines today's national framework alongside the GDPR.

    IAPP

11. 30 Jun 2003Law
    Personal Data Protection Code enacted (Legislative Decree 196/2003)

    Italy consolidated its privacy rules into the 'Codice Privacy', which governed data protection for over two decades and re-grounded the Garante's powers. It remains the national vehicle now adapted to the GDPR.

    privacy.it (Italian Privacy Code, English)

12. 31 Dec 1996Law
    Law 675/1996, Italy's first data protection law

    Implementing EU Directive 95/46/EC, Law No. 675 introduced comprehensive personal-data rules and established the Garante per la protezione dei dati personali as an independent authority. It is the foundation of the modern Italian privacy framework.

    privacy.it (Law 675/1996, English)

Sources

1. 1.garanteprivacy.it/web/garante-privacy-en
2. 2.garanteprivacy.it/web/garante-privacy-en/the-italian-data-protection-authority-who-we-a
3. 3.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-italy
4. 4.cliffordchance.com/content/dam/cliffordchance/briefings/2018/09/italy-implements-the-gdp
5. 5.dlapiperdataprotection.com/index.html?t=about&c=IT
6. 6.coe.int/en/web/data-protection/italy
7. 7.gdprfine.com/dpa/italy-garante
8. 8.getsolution.it/codice-privacy-d-lgs-101-2018/?lang=en
9. 9.panatolawfirm.com/en/blog/italy-garante-gdpr-enforcement-2026-foreign-companies.html
10. 10.recordinglaw.com/world-laws/world-data-privacy-laws/italy-data-privacy-laws/