In Italy the GDPR is only half the rulebook: the Personal Data Protection Code adds national rules, criminal offences and its own enforcement procedure, and the Garante is one of Europe's most active regulators. The Code (Legislative Decree 196/2003, rewritten by Legislative Decree 101/2018 to sit alongside the GDPR) governs special category and criminal data, employee monitoring, electronic marketing, traffic data and how the Garante investigates and fines. This guide covers what the Code adds to the GDPR, how the Garante works, where its inspections are aimed in 2026 and what recent decisions teach security teams. It does not repeat the GDPR basics in our GDPR Compliance Guide for Security Teams or the cross-country comparison in GDPR Variations in Six EU Member States. It is for privacy, security and HR technology leads with operations, staff or customers in Italy. Status line: checked against the Garante's coordinated text of the Code (version 12.0, April 2026) and Garante publications on 11 November 2026.
Key takeaways
- The Code fills the GDPR's opening clauses: age 14 for consent to online services (Art. 2-quinquies), Garante safeguard measures for genetic, biometric and health data (Art. 2-septies), strict limits on criminal data (Art. 2-octies) and national limits on data subject rights (Art. 2-undecies).
- Employee monitoring is labour law as well as privacy law: Articles 113 and 114 keep the Workers' Statute rules in force, and breaching the remote monitoring rule is a criminal matter under Article 171.
- Data crimes carry prison terms: unlawful processing (Art. 167), unlawful communication of large-scale databases (Art. 167-bis, 1 to 6 years) and fraudulent acquisition of large-scale databases (Art. 167-ter, 1 to 4 years).
- The Garante inspects to a published plan: at least 35 inspections for August to December 2026, covering public database breaches and access controls, email tracking pixels, health apps, municipal AI and dynamic pricing, often through the Guardia di Finanza.
- Security failures are fined hard, but courts review: Enel Energia's EUR 79.1 million fine for system weaknesses exploited by unauthorised sales agents was upheld at first instance, while the EUR 15 million OpenAI decision was annulled on appeal in March 2026.
How the Code fits with the GDPR
The GDPR applies directly. The Code adds rules where the GDPR lets Member States act, keeps sector law alive, sets the Garante's structure and procedure, and creates criminal offences. The Garante's coordinated text, version 12.0 of April 2026, includes amendments up to Decree-Law 19/2026 as converted by Law 50 of 20 April 2026; it is informational, and the Gazzetta Ufficiale text is authoritative.
| Topic | Code article | What Italy adds |
|---|---|---|
| Public sector legal basis | 2-ter | Processing for public tasks needs a law, regulation or general administrative act; certain sharing needs at least 10 days' prior notice to the Garante |
| Children and online services | 2-quinquies | Minors aged 14 or over may consent; below 14, parental consent; notices must be clear for minors |
| Substantial public interest | 2-sexies | A list of public interest areas (access to documents, tax, immigration, health services, employment and others) where special category data may be processed with legal safeguards |
| Genetic, biometric and health data | 2-septies | Processing also subject to Garante safeguard measures, adopted at least every two years after public consultation of at least 60 days; biometric data may be used for physical and logical access control within those measures; this data may not be disseminated |
| Criminal conviction and offence data | 2-octies | Outside official authority, only where a law or regulation authorises it with safeguards; listed areas include employment, insurance fraud, legal claims and anti-money laundering |
| Limits on data subject rights | 2-undecies | Rights under GDPR Articles 15 to 22 can be restricted where they would cause concrete harm, for example to anti-money laundering, whistleblower confidentiality, defensive investigations or tax enforcement |
| Deceased persons | 2-terdecies | Rights may be exercised by people with their own interest or family reasons, unless the person prohibited it in writing for online services |
| Designated persons | 2-quaterdecies | Controllers and processors may give specific tasks to expressly designated individuals, which is how Italian organisations formalise who may touch personal data |
| Medical research | 110 | Consent can be dispensed with where research is based on law, or where informing is impossible or disproportionate, with safeguards and an ethics committee opinion |
For the age rules and employer email metadata guidance compared with other countries, see GDPR Variations in Six EU Member States.
Workplace monitoring and security tooling
Article 113 keeps in force Article 8 of Law 300/1970 (the Workers' Statute) and Article 10 of Legislative Decree 276/2003 on collecting information about workers, and Article 114 keeps in force Article 4 of the Workers' Statute on remote monitoring. Article 171 makes breaches of Article 4(1) and Article 8 punishable under the Statute's own penalty provision. For security teams this is the part of Italian law most likely to touch daily operations.
| Tool | Why it is sensitive in Italy | What to do before deployment |
|---|---|---|
| Email and web proxy logging | Logs can allow remote monitoring of staff activity | Define purpose and retention, limit access, inform staff, and check whether a union agreement or Labour Office authorisation is needed |
| Data loss prevention and insider risk analytics | Profiles individual behaviour | DPIA, proportionality analysis, pseudonymised alerting where possible |
| Endpoint detection and response, screen capture | Can record content and activity in detail | Disable features not needed for security; document the security purpose |
| Biometric time clocks and door access | Biometric data under Art. 2-septies and Garante safeguard measures | Necessity test against card or PIN alternatives; no central storage unless justified |
| Vehicle and device location tracking | Continuous location of workers | Purpose limits, off-duty disablement, short retention |
The Garante's press summary of its 2025 annual report highlights a prohibition order against Amazon Italia Logistica over data on more than 1,800 workers, which shows the line it draws on excessive monitoring. See the Employee Monitoring and Privacy Guide.
Electronic communications, marketing and traffic data
- Consent for automated marketing (Art. 130): automated calls without an operator, email, fax, SMS and MMS for marketing need consent.
- Calls and post (Art. 130): operator calls and paper mail are allowed unless the person has registered in the public opposition register (Registro pubblico delle opposizioni).
- Soft opt-in (Art. 130): a customer's email may be used for similar products if the person was informed and can object at any time free of charge.
- Sender identity (Art. 130): hiding the sender or omitting a valid contact address is prohibited, and the Garante can order email providers to filter repeat offenders.
- Traffic data retention by providers (Art. 132): telephone traffic data 24 months, telematic traffic data 12 months (no content), unanswered calls 30 days; access for serious crimes needs a judge's authorisation, and prosecutors can order preservation for up to 90 days, extendable to six months.
- Provider security (Arts. 132-ter and 132-quater): security of processing for electronic communications providers, and a duty to tell subscribers about significant network security risks.
Telemarketing is the Garante's most persistent enforcement theme, and it is increasingly a security case: the risk is often unauthorised agents getting into customer systems rather than marketing consent alone.
The Garante: powers and procedure
| Feature | Rule | Article |
|---|---|---|
| Composition | A board (Collegio) of four members, two elected by each chamber of Parliament, for a single seven-year term | 153 |
| Tasks | Monitor compliance, handle complaints, promote codes of conduct, report crimes, annual report to Parliament by 31 May, opinions within 45 days | 154 |
| Information requests | Can require information and documents, including database content, from controllers, processors and others | 157 |
| Inspections | Access to databases, archives and premises, including online data acquisition; homes need consent or a court authorisation | 158 |
| Fine procedure | Notice of alleged violations, 30 days to send written defences or ask for a hearing; publication of the decision may be ordered | 166 |
| Early settlement | Paying half the fine within the appeal deadline and complying with orders closes the dispute | 166 |
| Fine bands for Code rules | Breaches of Art. 130, Art. 132 and Art. 157 fall in the GDPR Art. 83(5) band; breaches of Arts. 128, 129(2) and 132-ter in the Art. 83(4) band | 166 |
Article 166(7) also lets the Garante order corrective publicity, which it used for the first time against OpenAI. A practical point for incident responders: obstructing an inspection or giving false statements to the Garante is itself a crime (Art. 168).
Criminal offences
| Offence | Article | Penalty |
|---|---|---|
| Unlawful processing (marketing, traffic data rules) causing harm, for gain or to cause harm | 167 | 6 months to 1 year 6 months imprisonment |
| Unlawful processing of special category or criminal data, or unlawful transfer abroad | 167 | 1 to 3 years |
| Unlawful communication or dissemination of large-scale automated databases | 167-bis | 1 to 6 years |
| Fraudulent acquisition of large-scale automated databases | 167-ter | 1 to 4 years |
| False statements to the Garante | 168 | 6 months to 3 years |
| Non-compliance with a Garante order causing concrete harm | 170 | 3 months to 2 years, on complaint |
Articles 167-bis and 167-ter matter for insider and supplier threats: bulk extraction of customer databases by staff, agents or contractors can be prosecuted as well as fined.
Enforcement priorities and lessons
According to the Garante's press summary of its 2025 annual report, presented on 2 July 2026, it recorded more than EUR 37 million in fines collected, 2,415 personal data breach notifications, responses to 4,288 complaints, 130 inspections and 807 board decisions. Its semester inspection plan for August to December 2026 (Deliberation 545 of 23 July 2026) sets at least 35 inspections on:
- Security of public databases: breaches in significant public databases, including security systems and access controls, through an interdepartmental task force, plus technical reviews of large or sensitive breach notifications.
- Health: electronic health records and medical apps.
- Tracking: compliance with the April 2026 guidelines on tracking pixels in email, geomarketing and neuromarketing. See the Email Tracking Pixels Guide.
- Public sector: data protection officers of public bodies, municipal welfare services and their software suppliers, and AI systems used by municipalities and local health authorities.
- Pricing: dynamic pricing.
Decisions security teams should know
| Case | What happened | Lesson |
|---|---|---|
| Enel Energia, decision of 8 February 2024 | EUR 79,107,101 fine; serious security shortcomings in customer management and activation systems let unauthorised agents run calls and sign contracts; at least 9,300 contracts activated over time; upheld by the Court of Rome in September 2025, further appeal pending | Partner and agent access to CRM is a security control; treat sales channel identities like any third-party access |
| OpenAI, decision of 2 November 2024 | EUR 15 million fine and a six-month publicity campaign for failure to notify a March 2023 breach, no adequate legal basis for training, transparency failures and no age verification; annulled when the Court of Rome upheld OpenAI's appeal (judgment published 18 March 2026); later matters passed to the Irish DPC as lead authority | Breach notification failures draw fines, but one-stop-shop and court review shape outcomes |
| Amazon Italia Logistica (2025 annual report) | Prohibition order over data on more than 1,800 workers | Workforce analytics need proportionality and labour law checks |
Breach notification itself follows GDPR Article 33: notify the Garante without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals. See the Data Breach Notification Checklist and, for wider security fines, the GDPR Enforcement Decisions on Security Failures Guide.
Where identity fits
The Enel case is an access control story: outsiders acting through sales agents reached systems that should have been closed to them. The 2026 inspection plan names access controls on public databases. And the Article 167-bis and 167-ter offences target bulk extraction. All three point to the same controls: individual accounts for every agent, partner and integration, no shared credentials, least privilege on bulk export, and logs that attribute each query to a person or a named machine identity. Article 2-quaterdecies designations should map to real entitlements in the identity system, not only to a letter. See the Identity Data Privacy and Consent Guide.
Implementation sequence
- Map Italian deltas: list processing of special category, biometric and criminal data, children's data and research data against Arts. 2-sexies to 2-octies and 110.
- Apply the Garante safeguard measures: for genetic, biometric and health data, confirm the current measures and record compliance.
- Review monitoring tools with HR and labour counsel: for each tool in the workplace table, document purpose, retention, staff information and whether an agreement or authorisation under Workers' Statute Article 4 is needed.
- Check marketing flows: consent for automated channels, opposition register checks for calls and post, sender identity, and control of agents and lead sellers.
- Lock down bulk data access: designate who may process data (Art. 2-quaterdecies), restrict bulk export and monitor it.
- Prepare for inspection: a named contact, a document pack (records of processing, DPIAs, breach register, designations) and a rule that nothing misleading is said to inspectors.
- Track the semester plan: review each new Garante plan against your sector and fix gaps before your sector's window.
Decision guidance
- Main EU establishment outside Italy: the lead authority may be elsewhere for cross-border processing, but the Code's national rules, criminal law and Italian labour law still apply locally.
- Italian employer with security monitoring: treat labour law sign-off as a go-live gate, not an afterthought.
- Energy, telecoms and utilities: expect telemarketing and agent channel scrutiny; audit partner access.
- Public bodies and their software suppliers: expect DPO, access control and AI questions in 2026.
Measurement and framework mapping
- Monitoring tool coverage: share of monitoring tools with a documented labour law review and DPIA.
- Bulk export control: number of identities able to export full customer or employee datasets, and alerts reviewed.
- Agent and partner access: share of external sales and support identities that are individual, MFA protected and reviewed quarterly.
- Breach timeliness: share of notifiable breaches reported to the Garante within 72 hours.
- Inspection readiness: time to assemble the document pack in a drill.
| Requirement | Source | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Designated persons and least privilege | Code Art. 2-quaterdecies; GDPR Art. 32 | AC-2, AC-6 | 5.15, 5.18 |
| Special category data safeguards | Code Art. 2-septies | PT-7 | 5.34 |
| Workplace monitoring limits | Code Arts. 113, 114 | PT-3, AU-11 | 5.34 |
| Bulk extraction controls | Code Arts. 167-bis, 167-ter | AC-6, AU-6 | 8.12, 8.15 |
| Breach notification | GDPR Art. 33 | IR-6 | 5.26 |
| Third-party and agent access | Enel decision; GDPR Art. 32 | AC-2, SA-9 | 5.19, 5.20 |
Common failure patterns
- Global monitoring rollouts: deploying DLP, EDR or productivity analytics in Italy without the Workers' Statute review.
- Shared agent logins: sales and support partners on shared or weak accounts, the pattern behind the Enel fine.
- Unrestricted bulk export: staff and integrations able to download whole databases, now a criminal law exposure.
- Biometrics by default: fingerprint or face clocks chosen without the necessity test and Garante safeguard measures.
- Treating the Code as repealed: assuming the GDPR replaced the Code when it was rewritten and remains in force.
- Unprepared inspections: no named contact or document pack when the Guardia di Finanza arrives on the Garante's behalf.
Practitioner checklist
- Record Italian processing of special category, biometric, criminal and children's data against the Code articles.
- Confirm current Garante safeguard measures for genetic, biometric and health data.
- Run a labour law review and DPIA for every monitoring and security analytics tool.
- Check marketing consent, opposition register screening and agent controls.
- Issue Article 2-quaterdecies designations that match real access rights.
- Restrict and log bulk export from customer and employee systems.
- Keep a Garante inspection pack and contact list ready.
- Review each semester inspection plan against your sector.
Standards and references
- Garante per la protezione dei dati personali: Personal Data Protection Code, coordinated text
- Garante per la protezione dei dati personali: Inspection plan August to December 2026
- Garante per la protezione dei dati personali: Inspection activity
- Garante per la protezione dei dati personali: Telemarketing, Enel Energia sanctioned
- Garante per la protezione dei dati personali: ChatGPT, OpenAI corrective and sanctioning measures
- Garante per la protezione dei dati personali: Relazione sull'attività 2025, sintesi per la stampa
- ADVANT Nctm: Garante annual report 2025
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · GDPR Variations in Six EU Member States · Italy AI Law Guide · Italy NIS2 Implementation Guide. This guide summarises Italy's Personal Data Protection Code and Garante practice and is not legal advice. Source note: Code articles were read in the Garante's unofficial coordinated text (version 12.0, April 2026); the Gazzetta Ufficiale text is authoritative. Confirm against the official text before relying on it.