Processes personal data, in Italy

Regulation (EU) 2016/679, Art. 82; Codice di procedura civile, Art. 840-bis (as reformed by Legge 12 aprile 2019, n. 31) · Read the law's page

• Compensate any person in Italy who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) · Read the law's page

• Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Italy.
• Do not treat a publicly posted photograph or recording as freely processable for identification purposes; the Garante's Clearview AI decision found no valid legal basis for exactly that.

Regulation (EU) 2016/679, Arts. 12-21; D.Lgs. 196/2003, as amended by D.Lgs. 101/2018, Arts. 2-undecies, 2-terdecies · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Italy within one month of receipt.
• You may delay, limit or exclude a person's rights in Italy under GDPR Articles 15 to 22, with reasoned notice to them without delay unless that notice would defeat the purpose, where granting the request would cause actual and concrete prejudice to interests such as anti-money-laundering enforcement, defensive investigations or the exercise of a right in court, or a whistleblower's confidentiality, under Codice Article 2-undecies.
• Honor a request about a deceased person's personal data in Italy from someone with their own interest, an agent protecting the deceased, or someone with a family reason worth protecting, unless the law excludes it or, for information society services offered directly to the person, the deceased expressly forbade it by written declaration, under Codice Article 2-terdecies.

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the Garante without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Italy, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• If you are an enterprise with fewer than five employees, use the specific notification procedure that the Garante sets by its own measure under Article 2-quaterdecies.1(2) of the Codice privacy to meet the Article 33 notification duty.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Italy outside the EEA.

Decreto Legislativo 30 giugno 2003, n. 196, art. 110-bis, commi 1-3 · Read the law's page

• Where you rely on the Garante's authorization under Article 110-bis for further processing of personal data, special categories included, for scientific research or statistics as a third party that mainly carries out those activities, adopt the appropriate measures required by GDPR Article 89, including preventive minimization and anonymization of the data (Article 110-bis, paragraph 1).
• Comply with the conditions and measures the Garante sets in the authorization, or afterwards following verifications, or in a general measure, including those on the security of the data (Article 110-bis, paragraphs 2 and 3).

Decreto Legislativo 30 giugno 2003, n. 196, art. 126, comma 1 · Read the law's page

• Process location data other than traffic data, relating to users or subscribers of public communications networks or publicly available electronic communication services, only if the data are anonymous or the user or subscriber has given prior consent, revocable at any time, and only to the extent and for the duration needed for the requested value-added service (Article 126, paragraph 1).

Decreto Legislativo 30 giugno 2003, n. 196, art. 52, commi 4-5 · Read the law's page

• When you disseminate, in any form, a judgment or other judicial measure that carries the annotation provided for in Article 52, paragraph 2, or the legal maxims drawn from it, omit the data subject's name and other identifying data (Article 52, paragraph 4).
• When you disseminate judgments or other judicial measures of any court, omit in every case, with or without the annotation, the names and other identifying data, including data relating to third parties, from which the identity of a minor, or of the parties to family-law and personal-status proceedings, can be inferred even indirectly (Article 52, paragraph 5).

Decreto Legislativo 30 giugno 2003, n. 196, as amended by Decreto Legislativo 10 agosto 2018, n. 101 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Italy, following the Codice Privacy's institutional and procedural rules.

Regole deontologiche per trattamenti a fini statistici o di ricerca scientifica, Garante Provvedimento n. 515 del 19 dicembre 2018, Allegato 1, artt. 4 and 7 · Read the law's page

• Treat a data subject as identifiable whenever, with reasonable means, a significantly probable association can be established between the combination of the variables of a statistical unit and the data that identify it (Allegato 1, Article 4, paragraph 1, point a).
• Process special categories of data and data on criminal convictions and offences for statistical and scientific purposes in anonymous form as a rule (Allegato 1, Article 7, paragraph 1).

Garante Provvedimento n. 146 del 5 giugno 2019 · Read the law's page

• Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.
• Do not scrape or process publicly posted facial images to build a biometric identification database without a valid GDPR Article 9 basis.

Prescrizioni relative al trattamento di categorie particolari di dati, Garante Provvedimento n. 146 del 5 giugno 2019, Allegato 1, sections 4.2(e), 5.4 and 5.6 · Read the law's page

• Process genetic data and biological samples held in lists, registers or databases with encryption, pseudonymization or other solutions that make them temporarily unintelligible even to authorized staff and allow the data subjects to be identified only when necessary (Allegato n. 1, section 4.2, point e).
• Where research cannot reach its purposes without identifying the data subjects, process the data collected retrospectively with encryption, pseudonymization or other solutions that make them not directly attributable to the data subjects, and use codes that cannot be derived from the data subjects' identifying data unless that is impossible or disproportionate and the reason is recorded in writing in the research project (Allegato n. 1, section 5.4).
• State in the research project the retention period after the end of the study at the end of which the data and biological samples are anonymized (Allegato n. 1, section 5.6).

Legge 23 settembre 2025, n. 132, art. 8 · Read the law's page

• If you process data for research and experimentation in building AI systems for health purposes within Article 8 of Law 132/2025, communicate the processing to the Garante with the information required by GDPR Articles 24, 25, 32 and 35 and any processor named under Article 28, and start only thirty days after the communication unless the Garante has blocked it (Article 8, paragraph 5).
• If you reuse personal data without direct identifiers for that research without further consent, still inform the data subject, which a general notice on your website can satisfy, unless knowing the data subject's identity is inevitable or necessary to protect their health (Article 8, paragraph 2).
• Inform the data subject under GDPR Article 13 before processing personal data to anonymize, pseudonymize or synthesize it (Article 8, paragraph 3).

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).