🇮🇹Personal Data Protection Code

← Back to laws in Italy

Personal Data Protection Code

Italy applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Code adapts Italian law to the GDPR and preserves detailed national rules for public-interest processing, sensitive data, employment, research, journalism and electronic communications.

National additions and variations

• Article 2-quinquies sets 14 as the age for a child to consent to directly offered information-society services and requires especially clear child-facing information.
• Articles 2-sexies to 2-octies regulate substantial public-interest, genetic, biometric, health and criminal data, including safeguards prescribed by the Garante.
• Article 2-quater makes applicable deontological rules an essential condition of lawfulness for the covered processing.
• Articles 111 onward add employment rules, including spontaneous CVs, worker safeguards and workplace-control boundaries.
• Article 122 and related electronic-communications provisions regulate terminal access, cookies, traffic data and direct marketing.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.