Italy
Full entry AI-checked Checked 5 November 2026
Read this together with European Union, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Codice in materia di protezione dei dati personali (Privacy Code) | Decreto legislativo 30 giugno 2003, n. 196, as amended (notably by Decreto legislativo 10 agosto 2018, n. 101) | In force | 1 January 2004 |
| Registro pubblico delle opposizioni regulation | Decreto del Presidente della Repubblica 27 gennaio 2022, n. 26 | In force | 13 April 2022 |
| Italian AI law | Legge 23 settembre 2025, n. 132 (Disposizioni e deleghe al Governo in materia di intelligenza artificiale) | In force | 10 October 2025 |
| AI Act implementing decree | Decreto legislativo 7 ottobre 2026, n. 179 (GU n. 234 of 8 October 2026) | In force | 23 October 2026 |
- Codice in materia di protezione dei dati personali (Privacy Code): Italy’s data protection law, read with the GDPR and adapted to it from 19 September 2018. Article 122 sets the cookie rules and article 130 the marketing rules. Last amended in February 2026.
- Registro pubblico delle opposizioni regulation: Runs the national opt-out register for marketing calls and post under Law 5/2018, now covering all numbers, mobiles included.
- Italian AI law: Sets national principles for AI, parental consent for under-14s, transparency at work and the national AI Act authorities. The government has since adopted decrees under it, namely D.lgs. 160/2026 on police use of AI and AI liability (in force 30 September 2026) and D.lgs. 179/2026, listed below.
- AI Act implementing decree: Adapts Italian law to the EU AI Act. It sets the powers of the national AI authorities, the fines for AI Act breaches and a national AI sandbox, and adds rules on AI at work, including that a person takes final employment decisions.
Regulators
Section titled “Regulators”- Garante per la protezione dei dati personali
- Agenzia per la cybersicurezza nazionale (ACN), the main AI Act market surveillance authority and single point of contact
- Agenzia per l’Italia digitale (AgID), the AI Act notifying authority
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The GDPR sets who is covered. The Privacy Code adapts it to Italian law and adds national rules, such as the consent age, sector rules for work, health and research, and the rules on cookies and marketing. A deceased person’s rights can be exercised by someone with their own interest, acting for them or for family reasons, unless the person forbade it in writing for online services.
Sources: normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED · garanteprivacy.it/codice
Lawful bases
Section titled “Lawful bases”The GDPR’s six lawful bases apply. Processing for a public task needs a basis in law, regulation or a general administrative act, and since 2021 public bodies may also rely on what their tasks require. Genetic, biometric and health data must also follow the Garante’s safeguard measures. Data on criminal offences may be processed only where a law, or a regulation the law provides for, allows it with appropriate safeguards.
Sources: normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Consent age for online services
Section titled “Consent age for online services”When an online service offered directly to a child relies on consent, the child can consent from 14. Under 14, a holder of parental responsibility must give consent. Information for minors must be especially clear, simple and easy for them to understand.
Sources: normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED · garanteprivacy.it/temi/minori
Children
Section titled “Children”Under the 2025 AI law, children under 14 need a parent’s consent to use AI tools and for the related data processing. From 14 they can consent themselves if the information is easy to understand. Children from 14, or their parents, can ask a platform to remove cyberbullying content and go to the Garante if it doesn’t act. Anyone, including children from 14, can warn the Garante that intimate images may be shared, and it decides within 48 hours. Video-sharing platforms available in Italy must give it, or publish, a contact point for its orders.
Sources: normattiva.it/eli/id/2025/09/25/25G00143/CONSOLIDATED · garanteprivacy.it/temi/minori · garanteprivacy.it/temi/cyberbullismo · normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED
Cookies and similar technologies
Section titled “Cookies and similar technologies”Storing or reading information on a device needs consent, except to transmit a communication or where strictly needed for a service the user asked for (art. 122). The Garante’s 2021 guidelines say closing the banner with an X keeps only technical cookies, scrolling isn’t consent, cookie walls are unlawful unless there’s an equivalent alternative, and a refused banner shouldn’t return for six months. Analytics count as technical cookies only under strict conditions.
Sources: normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED · garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876
Electronic marketing
Section titled “Electronic marketing”Marketing by automated calls, email, fax, SMS or MMS needs prior consent (art. 130). A business may email its customers about products similar to what they bought without consent, if they were told and can object at any time. Calls with a live operator and post are allowed unless the person is on the Registro pubblico delle opposizioni, which covers all numbers, mobiles included. Joining it cancels earlier consents to marketing calls, live or automated, except under a contract that is current or ended no more than 30 days ago, or a consent given after joining.
Sources: normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED · garanteprivacy.it/temi/telemarketing · garanteprivacy.it/home/docweb/-/docweb-display/docweb/2542348 · gazzettaufficiale.it/eli/id/2022/03/29/22G00033/sg · normattiva.it/eli/id/2018/02/03/18G00021/CONSOLIDATED
Breach notification
Section titled “Breach notification”Under the GDPR, notify the Garante through its online service within 72 hours where feasible, and tell the people affected when the risk to them is high. Since 20 February 2026 the Code says businesses with fewer than five employees will use a simpler procedure, with guided self-assessment and support, once the Garante sets it up. As of 5 November 2026 its breach page offers only the standard online service.
Sources: garanteprivacy.it/regolamentoue/databreach · normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED
Registration and fees
Section titled “Registration and fees”No registration or fee for controllers. DPO contact details are filed through the Garante’s online service. Businesses that make marketing calls or send marketing post must check numbers and addresses against the Registro pubblico delle opposizioni, which charges them access fees.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · garanteprivacy.it/regolamentoue/rpd · normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED
Data protection officer
Section titled “Data protection officer”The GDPR rule applies, and Italy adds no general threshold for private bodies. The Garante’s FAQs give examples that usually need one, such as banks, insurers, utilities, call centres and private hospitals. DPO contact details must be filed through the Garante’s online service, the only channel it accepts.
Sources: garanteprivacy.it/faq-sul-responsabile-della-protezione-dei-dati-rpd-… · garanteprivacy.it/regolamentoue/rpd
International transfers
Section titled “International transfers”The GDPR rules apply, using adequacy decisions, safeguards such as standard contractual clauses or binding corporate rules, or the Article 49 exceptions. Ad hoc contractual clauses need the Garante’s authorisation. Under the Code, an unlawful transfer that harms someone, made for profit or to cause harm, is a crime punishable by one to three years in prison.
Sources: garanteprivacy.it/temi/trasferimento-di-dati-all-estero · normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED
Impact assessments
Section titled “Impact assessments”The GDPR rule applies, with a national list. The Garante’s list names 12 types of processing that need a DPIA, including large-scale scoring or profiling, employee monitoring through technology, regular processing of vulnerable people’s data such as children’s, and innovative technologies like IoT. Otherwise a DPIA is generally expected when two or more EDPB criteria apply.
Sources: garanteprivacy.it/home/docweb/-/docweb-display/docweb/9058979 · garanteprivacy.it/home/docweb/-/docweb-display/docweb/9059358
Automated decisions and AI
Section titled “Automated decisions and AI”Law 132/2025 requires employers to tell workers when they use AI. Since 23 October 2026 (D.lgs. 179/2026), a person, not AI alone, must take final decisions on hiring, changing or ending a job, discipline and appraisals. Screening applicants isn’t covered, and the worker’s consent is no exception. On request, a person must explain the decision. Decisions in breach are void. ACN is the main AI Act market surveillance authority, with the Bank of Italy, CONSOB and IVASS for finance and the Garante for high-risk AI in policing, borders, justice and democracy. AgID is the notifying authority.
Sources: normattiva.it/eli/id/2025/09/25/25G00143/CONSOLIDATED · eur-lex.europa.eu/legal-content/EN/TXT/HTML · normattiva.it/eli/id/2026/10/08/26G00200/CONSOLIDATED · normattiva.it/uri-res/N2Ls · normattiva.it/uri-res/N2Ls · normattiva.it/uri-res/N2Ls · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Penalties
Section titled “Penalties”The Garante fines under the GDPR tiers. Breaches of key national rules, including the consent age, cookie and marketing rules, carry the top tier of up to €20 million or 4% of worldwide turnover. Paying half the fine within the appeal deadline, and complying, settles the case. Some unlawful processing that harms people, done for profit or to cause harm, is also a crime, with prison terms from six months to six years. D.lgs. 179/2026 applies the AI Act’s fine ceilings and adds one of €1 million or 0.5% of turnover for the fundamental-rights impact assessment and explanation duties.
Sources: normattiva.it/eli/id/2003/07/29/003G0218/CONSOLIDATED · garanteprivacy.it/temi/telemarketing · normattiva.it/eli/id/2026/10/08/26G00200/CONSOLIDATED · normattiva.it/uri-res/N2Ls
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/it.yaml.