Sign in

Italy Privacy Code

Codice in materia di protezione dei dati personali (D.Lgs. 196/2003) — Italian Parliament / Government

Also known as: Codice privacy, D.Lgs. 196/2003, Italy PDPC 2018, Italian Data Protection Code

Official site Official change log Subscribe to Italy Privacy Code (RSS)

Current version
Legislative Decree 196/2003 (as last amended by Decree-Law 19/2026)
Published 19 February 2026. source
Status
In force
Next deadline
None announced
Who must comply
Processing of personal data in Italy, alongside the GDPR: the Code adds national rules on public interest processing, special category and criminal data, children's consent, electronic communications, health, research and journalism. source
How it is assessed
Controllers comply themselves under the GDPR, with national additions such as a simplified breach notification procedure for micro-enterprises. source
Authority
A legislative decree of the Italian Republic; the Garante per la protezione dei dati personali adopts corrective measures and imposes the GDPR and Code fines. source
Enforced by
The Garante adopts corrective measures and imposes fines on private and public bodies; unlawful processing that causes harm can also be a crime. source
Last change
None recorded yet

Italy's consolidated data protection statute, substantially rewritten to align national law with the EU General Data Protection Regulation. It governs processing by public authorities, employers, healthcare providers, journalists and marketers, carries the deontological rules annexed to the Code, and sets out the powers of the Italian data protection authority together with remedies and penalties.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. Law 50/2026 converts Decree-Law 19/2026, confirming the breach notification procedure for micro-enterprises (Article 2-quaterdecies.1)
  2. Legislative Decree 215/2025 amending the traffic data rules of Article 132 published
  3. Legislative Decree 101/2018 aligning the Code with the GDPR published
  4. The Personal Data Protection Code enters into force

Amendments

  1. Legislative Decree 196/2003 (as last amended by Decree-Law 19/2026) AmendmentCurrent text

    Article 12 of Decree-Law 19/2026, converted with amendments by Law 50 of 20 April 2026, inserts Article 2-quaterdecies.1: firms with fewer than five employees notify data breaches through a specific procedure set by the Garante. source

    More
    • The Garante's procedure is to offer guided self-assessment tools and a simplified assistance channel.
  2. Amended by Legislative Decree 215/2025 Amendment

    Article 9 amends Article 132 on retention of and access to telephone and internet traffic data, in the decree designating authorities under the e-evidence Regulation (EU) 2023/1543; published in the Official Gazette on 15 January 2026. source

  3. Amended by Law 182/2025 Amendment

    Article 72 of the simplification law for economic activities repeals paragraphs 2, 4 and 6 of Article 2-octies on processing of criminal conviction and offence data. source

  4. Amended by Decree-Law 19/2024 Amendment

    Article 44 of Decree-Law 19/2024, converted by Law 56 of 29 April 2024, amends Article 2-sexies on pseudonymised health data processed by health bodies and Article 110 on medical research. source

  5. Amended by Legislative Decree 101/2018 Major version

    Rewrote the Code to adapt Italian law to the GDPR, published in the Official Gazette on 4 September 2018. source

Show 1 older amendment
  1. Legislative Decree 196/2003 Major version

    The original Personal Data Protection Code, published in the Official Gazette of 29 July 2003 and in force from 1 January 2004, with some provisions from 30 July 2003. source

Who it applies to

The Code applies in Italy alongside the GDPR and sets national rules for specific kinds of processing and specific sectors.

Children's consent
A minor aged 14 or over can consent to processing for information society services offered directly to them; below 14, consent must come from the holder of parental responsibility (Article 2-quinquies). source
Special category data
Processing of special category data for substantial public interest is allowed only where EU law, or Italian law, regulation or general administrative act, specifies the data, operations and safeguards (Article 2-sexies). source
Criminal data
Processing of criminal conviction and offence data not under the control of official authority is allowed only if authorised by law or, where the law provides, regulation with appropriate safeguards (Article 2-octies). source
Traffic data
Providers keep telephone traffic data for 24 months and internet traffic data for 12 months for criminal investigation purposes (Article 132(1)). source

How compliance is assessed

Controllers comply themselves under the GDPR, with national additions such as a simplified breach notification procedure for micro-enterprises.

Micro-enterprise breaches
Firms with fewer than five employees notify personal data breaches under GDPR Article 33 through a specific procedure the Garante sets (Article 2-quaterdecies.1). source
Research impact assessment
Failing to carry out the impact assessment required for medical research under Article 110(1), or to consult the Garante where required, is subject to GDPR Article 83(4) fines (Article 166(1)). source

Enforcement and penalties

The Garante adopts corrective measures and imposes fines on private and public bodies; unlawful processing that causes harm can also be a crime.

GDPR Article 83(5) level

Breaches of provisions such as Articles 2-ter, 2-sexies, 2-octies, the electronic marketing rules of Article 130 and the traffic data rules of Article 132 (Article 166(2)). source

GDPR Article 83(4) level

Breaches of provisions such as Article 2-quinquies(2) on information for minors and Article 132-ter (Article 166(1)). source

1 to 3 years' imprisonment

Unlawful processing of special category or criminal data, or unlawful transfer abroad, for profit or to cause harm, that harms the data subject (Article 167(2)-(3)). source

6 to 18 months' imprisonment

Unlawful processing in breach of the electronic communications rules of Articles 123, 126 and 130, for profit or to cause harm, that harms the data subject (Article 167(1)). source

Who enforces
The Garante adopts the corrective measures of GDPR Article 58(2) and imposes the fines of GDPR Article 83 and of the Code, against both private parties and public authorities (Article 166(3)-(4)). source
Referral to prosecutors
The Garante passes evidence of a crime to the public prosecutor, and prosecutors inform the Garante of the offences in Article 167 (Article 167(4)-(5)). source

Documents

  1. Law text Decreto legislativo 30 giugno 2003, n. 196 - Normattiva (official consolidated text)
  2. Law text Codice in materia di protezione dei dati personali - coordinated text V 12.0, April 2026 (Garante, unofficial)
  3. Law text Decreto-legge 19 febbraio 2026, n. 19 - Normattiva

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Italy Privacy Code (RSS)