Data & Privacy · Italy
Data protection & privacy law in Italy (2026)
Italy shaded by its data & privacy status
Data protection in Italy: comprehensive law.
FrameworkEU General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) directly applicable, as supplemented nationally by the Italian Personal Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018). Supervised by the Garante per la protezione dei dati personali.
Italy has a comprehensive, in-force personal data protection regime built on the directly applicable GDPR together with the national Privacy Code (Legislative Decree 196/2003, substantially rewritten by Legislative Decree 101/2018 to align with the GDPR). The Garante per la protezione dei dati personali — an independent authority established in 1997 — is the GDPR Article 51 supervisory authority and is one of the most active data-protection regulators in the EU, with powers extending to administrative fines up to €20 million or 4% of worldwide turnover and additional criminal penalties for the most serious infringements.
GDPR & data protection in Italy
In Italy, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Garante per la protezione dei dati personali.
- Framework
- the GDPR (Regulation (EU) 2016/679) plus the national data-protection act
- Supervisory authority
- the Garante per la protezione dei dati personali
- Applies to
- any organisation processing the personal data of people in Italy, wherever the organisation is based
- Maximum fine
- €20 million or 4% of global annual turnover, whichever is higher
- Breach notification
- within 72 hours of becoming aware, to the supervisory authority
- DPO
- required for large-scale monitoring or large-scale special-category processing
The GDPR is bloc-wide; Italy supplements it with a national data-protection act and its own supervisory authority.
GDPR in Italy: FAQ
Yes. As an EU/EEA member, Italy applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Garante per la protezione dei dati personali.
The Garante per la protezione dei dati personali.
Up to €20 million or 4% of global annual turnover, whichever is higher.
A DPO is required where you carry out large-scale monitoring or process special-category data at scale.
Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.
Key points
GDPR (Regulation (EU) 2016/679) applies directly, complemented by the Italian Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018, which harmonised national rules with the GDPR and governs areas left to Member State discretion (public administration, health data, scientific research, criminal sanctions).
The Garante per la protezione dei dati personali, headquartered in Rome, is Italy's independent supervisory authority under GDPR Article 51. It is a collegiate body of four members elected by Parliament for a seven-year term and enforces both the GDPR and the e-Privacy Directive (2002/58/EC) in Italy.
Controllers and processors must satisfy the GDPR's full obligation set — lawful basis, transparency, data-minimisation, security, breach notification within 72 hours, DPIAs for high-risk processing, DPO appointment where required, and records of processing. Individuals enjoy the GDPR rights of access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making.
The Privacy Code sets the digital-consent age for information society services at 14 (Article 2-quinquies), preserves specific rules on employment, health, judicial and public-sector processing, and — unusually within the EU — maintains criminal penalties alongside GDPR administrative fines for the most serious violations.
The Garante is one of the EU's most active DPAs, issuing hundreds of decisions and multi-million-euro fines. Recent examples include a combined €12.5 million fine against Poste Italiane/Postepay for unlawful app tracking (April 2026) and €9.5 million against TIM S.p.A. for unlawful telemarketing (July 2026); maximum GDPR fines reach €20 million or 4% of global turnover.
Italy's data-protection regime now operates alongside additional EU rules (NIS2, Digital Services Act, Data Act, AI Act) and the Italian AI law (Law No. 132/2025), with the Garante retaining competence over personal-data aspects of AI-system processing in Italy.
Timeline - major decisions & events
The Garante fined the motorway operator €420,000 for using an employee's private Facebook, Messenger and WhatsApp content in disciplinary proceedings, breaching lawfulness, purpose-limitation and minimisation principles. It signals strict enforcement of workplace privacy limits.
EDPB ↗The Garante imposed a €5M fine on Luka Inc. for lacking a legal basis, transparency and any age-verification for its AI companion chatbot, and opened a fresh probe into its generative-AI training. It cemented Italy's role as a leading AI-privacy enforcer.
EDPB ↗The Garante imposed an urgent, definitive limitation on processing Italian users' data by China's DeepSeek after finding its responses inadequate and noting data was stored in China contrary to GDPR safeguards. It was the first major EU action against the Chinese model.
Bird & Bird ↗Closing its ChatGPT inquiry, the Garante fined OpenAI €15M for processing training data without an adequate legal basis, transparency failures, weak age verification and an unreported 2023 breach, and ordered a six-month public information campaign. It was the first GDPR penalty against a generative-AI provider.
Garante per la protezione dei dati personali ↗OpenAI restored ChatGPT access in Italy after adopting transparency notices, an opt-out for training, age-gating and other measures demanded by the Garante. It set an early template for EU-wide AI compliance expectations.
Garante per la protezione dei dati personali ↗Italy became the first country to suspend ChatGPT, ordering OpenAI to halt processing of Italian users' data over the lack of a legal basis for training, missing transparency and absent age verification. It opened the global wave of AI data-protection scrutiny.
Garante per la protezione dei dati personali ↗The Garante issued an urgent order halting Replika's processing of Italian users' data, citing risks to minors and vulnerable people, no effective age checks and an invalid contract-based legal basis. It was an early marker of AI-specific enforcement.
Portolano Cavallo ↗The decree amended the 2003 Privacy Code, repealing provisions incompatible with the GDPR and legislating in areas left to member states (public sector, health data, research, criminal sanctions, age-14 consent for online services). It defines today's national framework alongside the GDPR.
IAPP ↗Italy consolidated its privacy rules into the 'Codice Privacy', which governed data protection for over two decades and re-grounded the Garante's powers. It remains the national vehicle now adapted to the GDPR.
privacy.it (Italian Privacy Code, English) ↗Implementing EU Directive 95/46/EC, Law No. 675 introduced comprehensive personal-data rules and established the Garante per la protezione dei dati personali as an independent authority. It is the foundation of the modern Italian privacy framework.
privacy.it (Law 675/1996, English) ↗Italy - other topics
Data & Privacy in other countries
Last verified 10/6/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →