Italy
Italian Privacy Law: An Overview

Italian privacy law runs on two tracks that most readers arrive already conflating: a household exemption that lets a homeowner do a surprising amount without asking anyone, and a full GDPR compliance regime that applies the moment personal data leaves that strictly private sphere.
This page orients that landscape and introduces the regulator that sits over all of it, the Garante per la protezione dei dati personali, then points to the two pages in this section that go deep on a home camera's boundaries and on how to actually bring a complaint.
Information verified on 20 July 2026. This page provides general legal information and does not constitute legal advice for an individual situation.
The household exemption, and where it ends
A private individual may install a camera to protect their own home without any prior authorisation, provided the camera's field of view stays within their own exclusive property. That is the Garante's own settled position, and it covers the single most common privacy question this site sees: can I put a camera on my house.
The exemption is conditional on scope, not on intent. It excludes a shared courtyard or stairwell, a neighbour's property, and the public street, even where the owner's only goal is protecting their own front door or car. Crossing that boundary brings the ordinary GDPR and Codice Privacy obligations into play for the excess portion of the frame, and can separately raise the criminal offence at art. 615-bis c.p., interferenze illecite nella vita privata.
Our page on home security cameras in Italy works through that boundary in full: what a strictly personal camera may capture, how long footage may realistically be kept, the separate and stricter rule for a condominium's shared entrance or courtyard, and what a neighbour can actually do if a camera reaches their property.
The Garante: Italy's privacy regulator
The Garante per la protezione dei dati personali is the independent authority behind all of this. It checks that organisations, and in some cases individuals, comply with the GDPR and the Codice Privacy, it can order corrective measures, and it examines formal complaints, called reclami, from the public.
What it is not is a court that pays money to a complainant. Its tools run toward an organisation's own practices: a corrective order, a restriction on processing, or, in serious cases, an administrative fine that goes to the State rather than to the person who complained. Someone who has suffered genuine, provable harm has a separate civil route under GDPR art. 82, which can run alongside a Garante complaint rather than instead of it.
Our page on the Garante and how to file a reclamo covers the actual complaint procedure: how a reclamo differs from the lighter weight segnalazione, what the Garante's own form asks for, where to send it, and what the Authority's own 2025 activity figures show about how active it genuinely is.
Two topics with their own dedicated depth
Two situations recur often enough in Italian privacy disputes that they deserve pointing to directly, even though the mechanics live on the pages above. A camera reaching beyond a homeowner's own property is the most common trigger for a reclamo this site's coverage addresses, and the boundary is precise rather than a matter of judgment call. And where a camera sits on a condominium's own shared entrance or courtyard rather than an individual owner's property, a separate rule applies entirely, covered in the condominium law section of this site, since that situation turns on an assembly vote rather than the household exemption.
Recording a conversation, as distinct from filming with a camera, follows a different rule again, covered in this site's Italy recording law coverage. For the fuller range of Italy coverage on this site, see the Italy hub.
Frequently Asked Questions
Do I need permission to put a security camera on my own house in Italy?
No, as long as the camera's field of view stays within your own property. The Garante's guidance treats a strictly personal or domestic camera as exempt from the ordinary authorisation and compliance duties that apply to organisations.
What is the Garante per la protezione dei dati personali?
Italy's independent data protection authority, responsible for supervising compliance with the GDPR and the national Codice Privacy, examining complaints from the public, and imposing corrective measures or fines on organisations that breach the rules.
Can the Garante get me compensation if my privacy was violated?
No. The Garante can order an organisation to change its practices and, in serious cases, impose a fine paid to the State, but it does not award money to the person who complained. A separate civil claim before a court is the route for compensation.
What happens if my home camera also captures my neighbour's property?
That portion of the footage falls outside the household exemption, which brings ordinary GDPR duties into play and can also raise the criminal offence at art. 615-bis c.p. Our page on home security cameras covers the fix, which is usually narrowing the camera's angle rather than removing it.
Is filing a complaint with the Garante free?
Yes. A reclamo can be filed by certified email, registered post, or in person, at no cost, and the Garante is obliged to examine it once filed.
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
General Data Protection Regulation (GDPR)
Art. 2Material scopeIn forcecited in 6 of our articles
1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. 3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. 4.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 60 court opinionsMost recently applied by a court: 2026
Leading cases:
- Österreichische Datenschutzbehörde v WK (Court of Justice of the European Union 2024, C-33/22)
- Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Court of Justice of the European Union 2020, C-311/18)
- European Commission v Republic of Poland (Court of Justice of the European Union 2023, C-204/21)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Ireland Data Protection Law: DPC Complaints, CCTV and Recording, Home CCTV and Doorbell Cameras in Ireland: The Law in 2026, Recording Conversations in Italy: When It Is Legal (and When It Is a Crime)
Art. 6Lawfulness of processingIn forcecited in 9 of our articles
1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 42 court opinionsMost recently applied by a court: 2026
Leading cases:
- Meta Platforms Inc and Others v Bundeskartellamt (Court of Justice of the European Union 2023, C-252/21)
- Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect (Court of Justice of the European Union 2025, C-394/23)
- Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens (Court of Justice of the European Union 2024, C-621/22)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Employer Guide to Wearable Recording Device Policies (2026), Wearable Recording Devices at Work: Complete Legal Guide (2026), Finland Recording Laws: One-Party Consent, NCII, and AI Rules (2026)
Art. 77Right to lodge a complaint with a supervisory authorityIn forcecited in 6 of our articles
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. 2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.
Official text (excerpt) · last checked 2026-08-12 · Read the full text in our law library · Verify at eur-lex.europa.eu
Cited in 15 court opinionsMost recently applied by a court: 2025
Leading cases:
- Österreichische Datenschutzbehörde v F R (Court of Justice of the European Union 2025, C-416/23)
- Nemzeti Adatvédelmi és Információszabadság Hatóság v UC (Court of Justice of the European Union 2024, C-169/23)
- Österreichische Datenschutzbehörde v WK (Court of Justice of the European Union 2024, C-33/22)
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How to File a Data Protection Complaint (Beschwerde) with Austria's DSB, The Garante Privacy: Italy's Data Protection Authority and How to Complain
Search our record of EU legislation — GDPR, ePrivacy, AI Act and more, from EUR-Lex →
Sources and References
- Garante per la protezione dei dati personali, Compiti(garanteprivacy.it).gov
- Garante per la protezione dei dati personali, Provvedimento in materia di videosorveglianza, 8 aprile 2010 [1712680](garanteprivacy.it).gov
- Regolamento (UE) 2016/679 (GDPR), art. 2, par. 2, lett. c) (household exemption) and art. 6 (lawfulness of processing)(eur-lex.europa.eu).gov
- Decreto Legislativo 30 giugno 2003, n. 196, Codice in materia di protezione dei dati personali(normattiva.it).gov
- art. 615-bis c.p., Interferenze illecite nella vita privata (Codice Penale, R.D. 19 ottobre 1930, n. 1398)(normattiva.it).gov
- Regolamento (UE) 2016/679 (GDPR), art. 77 (Diritto di proporre reclamo all’autorita di controllo)(eur-lex.europa.eu).gov