Handles health records, in Italy

Prescrizioni relative al trattamento di categorie particolari di dati, Garante Provvedimento n. 146 del 5 giugno 2019, Allegato 1, sections 4.2(e), 5.4 and 5.6 · Read the law's page

• Process genetic data and biological samples held in lists, registers or databases with encryption, pseudonymization or other solutions that make them temporarily unintelligible even to authorized staff and allow the data subjects to be identified only when necessary (Allegato n. 1, section 4.2, point e).
• Where research cannot reach its purposes without identifying the data subjects, process the data collected retrospectively with encryption, pseudonymization or other solutions that make them not directly attributable to the data subjects, and use codes that cannot be derived from the data subjects' identifying data unless that is impossible or disproportionate and the reason is recorded in writing in the research project (Allegato n. 1, section 5.4).
• State in the research project the retention period after the end of the study at the end of which the data and biological samples are anonymized (Allegato n. 1, section 5.6).

D.Lgs. 4 settembre 2024, n. 138, Art. 25 · Read the law's page

• This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes are reached as on this jurisdiction's companion risk-management row. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs reports under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.
• Notify CSIRT Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact.
• Follow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an incident still ongoing at that point, a monthly progress report and a final report within one month of the incident's resolution).
• Where you are a trust-service provider, notify within 24 hours rather than 72 for an incident affecting the trust services you supply.

D.Lgs. 4 settembre 2024, n. 138, Artt. 23 e 24 · Read the law's page

• Adopt technical, operational and organisational measures adequate and proportionate to the risks facing the network and information systems you use in your activities or in providing your services, and to prevent or minimise the impact of an incident on the recipients of your services and on other services.
• Cover at least: risk-analysis and information-system security policies; incident handling, including the procedures and tools to carry out the Article 25 and 26 notifications; business continuity, including backup management, disaster recovery and crisis management; and supply-chain security.
• Have your management and governing bodies approve how these measures are implemented and oversee their implementation, see that they attend cybersecurity training, and promote similar training for your employees.
• This binds an essential or important entity under Article 3; Article 7(5) names the cloud computing, online marketplace, online search engine and social-network platform providers among the entities it reaches, and the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure and public administration) are reached too, by declaring that you are an essential or important entity. An entity of sectors 3 and 4 of Annex I that Regulation (EU) 2022/2554 governs answers under that Regulation instead, because Article 3, paragraph 14 sets Chapters IV and V of this decree aside for it.

Legge 23 settembre 2025, n. 132, art. 8 · Read the law's page

• If you process data for research and experimentation in building AI systems for health purposes within Article 8 of Law 132/2025, communicate the processing to the Garante with the information required by GDPR Articles 24, 25, 32 and 35 and any processor named under Article 28, and start only thirty days after the communication unless the Garante has blocked it (Article 8, paragraph 5).
• If you reuse personal data without direct identifiers for that research without further consent, still inform the data subject, which a general notice on your website can satisfy, unless knowing the data subject's identity is inevitable or necessary to protect their health (Article 8, paragraph 2).
• Inform the data subject under GDPR Article 13 before processing personal data to anonymize, pseudonymize or synthesize it (Article 8, paragraph 3).