ItalyLaw 132/2025 Article 8, Health Data Processing for Research and Experimentation in Building AI Systems
Legge 23 settembre 2025, n. 132, art. 8
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Reporting, Disclosure
As of .
What it requires
- If you process data for research and experimentation in building AI systems for health purposes within Article 8 of Law 132/2025, communicate the processing to the Garante with the information required by General Data Protection Regulation (GDPR) Articles 24, 25, 32 and 35 and any processor named under Article 28, and start only thirty days after the communication unless the Garante has blocked it (Article 8, paragraph 5).
- If you reuse personal data without direct identifiers for that research without further consent, still inform the data subject, which a general notice on your website can satisfy, unless knowing the data subject's identity is inevitable or necessary to protect their health (Article 8, paragraph 2).
- Inform the data subject under GDPR Article 13 before processing personal data to anonymize, pseudonymize or synthesize it (Article 8, paragraph 3).
Who enforces it
Enforcement body
Garante per la protezione dei dati personali, whose inspection, prohibition and sanctioning powers remain unaffected by Article 8.
What this law does
Processing of data, including personal data, by non-profit public and private bodies, IRCCS research hospitals and private health-sector bodies in projects with them, for research and experimentation in building AI systems for health purposes, is declared to be of substantial public interest under General Data Protection Regulation (GDPR) Article 9(2)(g).
For the same purposes, secondary use of personal data without direct identifiers, including special category data, is always authorized without further consent where consent was initially required by law, subject to the duty to inform the data subject, except where knowing the data subject's identity is inevitable or necessary to protect their health.
Processing to anonymize, pseudonymize or synthesize personal data, including special category data, is always allowed after the data subject has been informed under GDPR Article 13. The processing under paragraphs 1 and 2 must be communicated to the Garante with the information required by GDPR Articles 24, 25, 32 and 35 and the processors named under Article 28, and may start thirty days after the communication unless the Garante has blocked it.
When LexLint raises it
When your app profile says your app handles health records or trains models.