ItalyGDPR Articles 33-34, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Garante without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Italy, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- If you are an enterprise with fewer than five employees, use the specific notification procedure that the Garante sets by its own measure under Article 2-quaterdecies.1(2) of the Codice privacy to meet the Article 33 notification duty.
These lines are LexLint's reading of the law's text. Also read by: Garante per la protezione dei dati personali (Italian Data Protection Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.garanteprivacy.it/data-breach
- Guidance body
- Garante per la protezione dei dati personali (Italian Data Protection Authority)
- Open questions
- Which specific notification procedure must an enterprise with fewer than five employees follow to meet Article 33 of Regulation (EU) 2016/679 under Article 2-quaterdecies.1 of the Codice privacy?
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller documents every personal data breach, whether or not it is notified. The text names the facts, the effects and the remedial action but no fixed log fields.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5)
- Trigger
- security_incident
What this law does
A controller must notify the Garante without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk. In Italy the supervisory authority under General Data Protection Regulation (GDPR) Article 51 is the Garante per la protezione dei dati personali.
Under Article 2-quaterdecies.1(1) of the Codice privacy, enterprises with fewer than five employees use a specific notification procedure to meet the duty in Article 33 of the Regulation. Article 2-quaterdecies.1(2) leaves that procedure to a measure of the Garante, which is to provide guided self-assessment tools and a simplified assistance channel. The provision was inserted by Article 12(1) of Decree-Law 19 of , converted with amendments by Law 50 of .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .