Italy Data Protection Code — Legislative Decree 196/2003

Why does it matter?

The Code is the Italian layer on top of the GDPR, so compliance with the GDPR alone leaves gaps: the Garante enforces both, and several of the Code's rules carry their own administrative fines or criminal penalties.

Key benefits include:

• Italian rules the GDPR leaves open

Article 2-quinquies sets the age of digital consent at 14, Article 2-sexies covers special categories processed for substantial public interest, and Article 2-septies adds Garante safeguard measures for genetic, biometric and health data.

• Criminal exposure

Articles 167, 167-bis and 167-ter create offenses, with prison terms from six months up to six years, for unlawful processing, unlawful disclosure of large-scale databases and fraudulent acquisition of them.

• Cookie and marketing rules

Article 122 requires consent to store or read information on a user's device, and Article 130 requires consent for automated calls and electronic marketing.

• An active national regulator

The Garante handles complaints under Article 142 and exercises the investigative and corrective powers of Article 58 of the GDPR through Articles 154 to 160.

• Current text to apply

The Code changed in 2024, 2025 and 2026, including Article 110 on medical research and the new Article 2-quaterdecies.1 for micro-enterprises.

How does it work?

Article 1 makes the GDPR and the Code the two sources of rules for processing. The Code does not repeat GDPR principles, rights or the controller's duties; it fills the spaces the GDPR delegates to national law, such as the lawful basis of public tasks in Article 2-ter, the exercise of rights of deceased persons in Article 2-terdecies and the limits on data subject rights in Article 2-undecies, for example where anti-money-laundering interests would be harmed.

Part II adds sector rules: Title V on health, Title VII on research, Title VIII on employment (Article 114 preserves Article 4 of the Workers' Statute on remote monitoring), and Title X on electronic communications (Articles 121 to 132-quater). Part III sets out the Garante's structure and powers, the complaint procedure and the penalties.

Controllers and processors may assign tasks to designated persons who act under their authority (Article 2-quaterdecies), and the Garante issues general provisions, deontological rules (Article 2-quater) and the guarantee measures of Article 2-septies, which it must update at least every two years after public consultation.

Key Elements

• Children's consent (Article 2-quinquies)

A minor who is 14 or older may consent to information society services offered directly to them; below 14, consent must come from the person with parental responsibility, and the controller writes child-readable information.

• Special categories and criminal data (Articles 2-sexies and 2-octies)

Processing for substantial public interest needs a legal basis that names the data, operations, interest and safeguards; criminal-conviction data needs a law or regulation with appropriate guarantees.

• Health, genetic and biometric data (Article 2-septies)

Processing follows guarantee measures set by the Garante, reviewed at least every two years after at least 60 days of public consultation.

• Electronic communications (Articles 121 to 132)

Title X covers terminal-equipment access and cookies (122), traffic data (123), unsolicited communications (130) and retention of traffic data (132: 24 months for telephone traffic, 12 months for electronic traffic, 30 days for unanswered calls).

• Garante and remedies (Articles 140 to 160)

Complaints go to the Garante (141 to 143); the Collegio has four members elected by the two chambers of Parliament for a single seven-year term (153).

• Sanctions (Articles 166 to 172)

Administrative fines apply at the tiers of Article 83(4) and (5) of the GDPR, and Articles 167 to 172 define the crimes and accessory penalties.

What does it cover?

The Code applies to personal data processing carried out under the GDPR in Italy, by public bodies and private organizations, and its Title X applies to providers of electronic communications services and to anyone who stores or reads information on a user's device. Article 58 makes separate provision for processing for national security or defense purposes, and Article 2-novies for processing by the Presidency of the Republic, Parliament and the Constitutional Court. Judicial processing has its own rules in Part II, Title I, and administrative fines do not apply to processing in judicial functions (Article 166(10)).

What are its objectives?

The Code states two purposes: Article 1 puts processing under the GDPR and the Code with respect to human dignity and fundamental rights, and Article 2 adapts national law to the GDPR.

Make the GDPR directly workable in Italian law by designating the Garante as supervisory authority (Article 2-bis) and fixing national rules where the GDPR delegates.

Protect children by requiring parental consent below 14 for online services and plain-language information (Article 2-quinquies).

Limit processing of special categories and criminal-offense data to cases a law, regulation or Garante measure allows (Articles 2-sexies, 2-septies and 2-octies).

Regulate electronic communications: cookies, traffic data, direct marketing and data retention (Title X, Articles 121 to 132).

Deter violations with administrative fines (Article 166) and criminal offenses (Articles 167 to 172).

Framework in Context

The Code sits between the GDPR (directly applicable) and sector law. It implements Directive 2002/58/EC (ePrivacy) through Title X, and it works with the Garante's guidelines on cookies, employee monitoring, health data and data breach notification. Italy's Law 182 of 2 December 2025 repealed paragraph 2 of Article 2-octies, Law 56/2024 amended Article 110 on medical and epidemiological research, and Legislative Decree 215/2025 changed Article 132 on traffic data retention. Compliance programs therefore track both the Garante's coordinated text and its published decisions.

Common Framework Mappings

Organizations map the Code's national rules to the frameworks below so one set of controls and records serves the GDPR, the Garante and international privacy programs.

Mapped frameworks include:

Convention 108+

ePrivacy Regulation

GDPR

ISO 27001:2022

ISO 27701

ISO 29100

NIST Privacy Framework v1.0

OECD Privacy Guidelines