GDPR in Italy: How the Codice Privacy and the Garante Fit Together

GDPR does not work differently in Italy than anywhere else in the European Union. Regolamento (UE) 2016/679 applies directly, exactly as written, to any organisation processing the personal data of people in Italy. What changes from one member state to the next is the layer of national law sitting underneath it, and in Italy that layer is genuinely active.

This page is not a general introduction to GDPR. For the mechanics of the Regulation itself, lawful bases, data subject rights, the accountability principle, see our GDPR explainer and the wider Italy data privacy overview. What follows is the Italy specific layer: how the Codice Privacy relates to the Regulation, what the Garante actually does, and the handful of rules that exist only because Italy chose to add them.

Information verified on 21 July 2026. This page provides general legal information and does not constitute legal advice for an individual situation.

GDPR direct effect, and a Codice Privacy that was amended, not replaced

Reg. UE 2016/679, the GDPR, applies directly in every EU member state without needing to be transposed into national law. Italy already had its own data protection statute, the Codice in materia di protezione dei dati personali (D.Lgs. 196/2003), which predates the GDPR by more than a decade.

Rather than repeal it, Italy amended it. D.Lgs. 10 agosto 2018, n. 101 rewrote large parts of the Codice Privacy, in force from 19 September 2018, to align it with the Regulation rather than duplicate or contradict it. Art. 2 of the Codice Privacy, as it now reads, states its own purpose plainly: it exists «per l'adeguamento dell'ordinamento nazionale alle disposizioni del regolamento», to adapt Italian law to the Regulation.

The result is two texts that interlock rather than compete. The GDPR supplies the substance: the lawful bases, the rights, the accountability duties, the enforcement ceilings. The Codice Privacy supplies the domestic detail the Regulation deliberately leaves to member states: who enforces it, the age at which a minor can consent, what happens to a deceased person's data, and a handful of sector rules the Regulation does not reach at all.

The Garante, briefly, and where the full procedure lives

The Garante per la protezione dei dati personali is the authority behind both texts in Italy. It supervises compliance, investigates, and can order an organisation to change how it processes data or pay an administrative fine.

If you are looking specifically for how to file a reclamo, a formal complaint, our companion page on the Garante covers the procedure, the deadlines, and what the authority can and cannot do for an individual complainant, in full. This page assumes that background and focuses instead on what is distinctly Italian in the substantive rules.

Scenario: the data of someone who has died

GDPR itself has nothing to say about a deceased person's data. The question is left to member states, and Italy answered it in art. 2-terdecies of the Codice Privacy.

Take a concrete case. A woman dies, and her adult son wants access to her cloud photo storage and wants a social media account closed. Under art. 2-terdecies, the rights the GDPR gives a living person, access, rectification, erasure and the rest, at artt. 15 to 22 of the Regulation, can be exercised after death by someone with their own interest in the matter, by someone acting to protect the deceased as their mandatario, or for protected family reasons.

The deceased can block this in advance, but only narrowly. The prohibition has to be an express written declaration given to the data controller, and it only applies to the direct offer of information society services, not to data generally. Even where a valid prohibition exists, it cannot be used to defeat a third party's own property rights arising from the death, or someone's right to defend themselves in court, and the declaration is revocable at any time.

Scenario: a minor and an app that wants their data

GDPR sets a default age of 16 for a minor to validly consent to their own data being processed for an information society service, art. 8 of the Regulation, but lets each member state lower it to any point down to 13. Italy set its own figure at 14, in art. 2-quinquies of the Codice Privacy.

A concrete example makes the line clear. A 13 year old downloads a social app and taps «accetto» during signup. Under Italian law that consent is not valid on its own: processing based on it is only lawful if a person exercising responsabilità genitoriale, parental responsibility, gave it instead. A 15 year old doing the identical thing can validly consent themselves, because they have already crossed Italy's threshold.

The same article adds a practical duty on the service. Where it targets minors directly, the information about the processing has to be written in language a minor can actually understand: clear, simple and complete, not the standard adult facing privacy policy.

Scenario: an employer wants to watch its workers

This is where GDPR meets a much older Italian statute, and readers often assume clearing one clears the other. It does not.

Art. 4 of the Statuto dei Lavoratori (L. 300/1970) governs impianti audiovisivi e altri strumenti di controllo, video systems and any other tool capable of monitoring workers remotely, even where surveillance is not the tool's main purpose. Installing one for organisational, production, safety or asset protection reasons requires an accordo collettivo with the works council first. Failing an agreement, the employer needs authorisation from the local Ispettorato Nazionale del Lavoro instead. Two categories sit outside this requirement: tools a worker uses to actually do their job, and ordinary access or attendance recorders.

A worked example: a warehouse installs CCTV covering its loading bay, which incidentally frames the packing stations where staff work. That needs the art. 4 procedure, agreement or Ispettorato authorisation, before it goes live. A separate badge reader logging when staff enter the building sits inside the carve out and does not need it.

Clearing art. 4 is only step one. The same article says the information collected can be used for employment purposes only where the worker was given adeguata informazione, adequate notice, of how the tools work and how monitoring happens, and only nel rispetto of the Codice Privacy. In practice that means a GDPR compliant informativa on top of the labour law authorisation, not instead of it. An employer with a lawfully authorised camera that never told staff it existed has not satisfied the Codice Privacy side of the rule.

A few more places the Codice Privacy still speaks for itself

Two further rules round out the genuinely Italian layer. Special categories of data, genetic, biometric and health data, get an extra safeguard under art. 2-septies: the Garante has to issue and periodically update «misure di garanzia», specific safeguards for processing these categories, revisited at least every two years and put out for public consultation first.

Art. 2-quaterdecies adds an organisational rule of its own: a data controller or processor can formally assign specific data processing tasks to named individuals acting under its authority, a mechanism the Regulation does not spell out itself.

None of this changes the fine ceilings GDPR sets. Where the Garante does move to a sanction, art. 83 of the Regulation still caps it at 20 million euro or 4 percent of an organisation's worldwide annual turnover, whichever is higher, for the most serious infringements, exactly as it would anywhere else in the Union.

Where an Italian reader actually goes

For the reclamo procedure itself, see the Garante companion page. For the mechanics of GDPR generally, lawful bases, the rights catalogue, the accountability principle, see our GDPR explainer, and for the broader country picture see the Italy data privacy overview.

Two adjacent topics worth knowing about: home security cameras in Italy, where the private, non employment version of the camera question lives, and recording conversations in Italy, a related but distinct question about capturing, rather than storing, someone else's information. For the fuller range of Italy privacy coverage, see the Italy privacy law section.