Italian Personal Data Protection Code (Codice Privacy)Supported in OneClickComply

Meet the Italian Privacy Code alongside your GDPR controls

The Italian Privacy Code (Codice in materia di protezione dei dati personali, Legislative Decree 196/2003) is Italy's national data protection law, which since Legislative Decree 101/2018 supplements the GDPR rather than replacing it.

See the Italian Privacy Code requirements

Official name: Codice in materia di protezione dei dati personali, Legislative Decree No. 196 of 30 June 2003
In force since: 1 January 2004; aligned with the GDPR by Legislative Decree No. 101 of 10 August 2018
Enforced by: Garante per la protezione dei dati personali
Applies to: Controllers and processors handling personal data in Italy, alongside the GDPR

Italian Privacy Code mapped

Automated evidence

Continuous monitoring

Who needs the Italian Privacy Code

Is the Italian Privacy Code right for your organisation?

It sets Italian rules on special category and criminal data, employment monitoring, healthcare, research, cookies and direct marketing. It is enforced by the Garante per la protezione dei dati personali, Italy's data protection authority.

Any organisation subject to the GDPR that processes personal data in Italy must also comply with the Italian Privacy Code. This includes companies with Italian employees, customers or website users, as well as healthcare, research and electronic communications providers with sector-specific duties. It becomes pressing when you hire in Italy, run marketing or cookies aimed at Italian users, or face due diligence from Italian clients.

How we help

How OneClickComply helps with the Italian Privacy Code

OneClickComply supports the Italian Privacy Code today, so GDPR and ISO 27001 controls you already run can be reused rather than rebuilt. OneClickComply collects security evidence automatically, generates privacy and security policies from your real environment and tracks processors through vendor risk management. Our in-house audit team can advise on Italian specifics such as employee monitoring and marketing consent through Ask an Auditor.

Requirements covered

Around 186 numbered articles in three parts (general provisions, sector-specific processing and data subject protection and sanctions), many repealed in 2018, with Italian GDPR supplements in Articles 2-bis to 2-septiesdecies, cookies and marketing in Articles 122 and 130, and fines in Article 166.

Official name: Codice in materia di protezione dei dati personali, Legislative Decree No. 196 of 30 June 2003
In force since: 1 January 2004; aligned with the GDPR by Legislative Decree No. 101 of 10 August 2018
Enforced by: Garante per la protezione dei dati personali
Applies to: Controllers and processors handling personal data in Italy, alongside the GDPR
Administrative fines: GDPR Article 83 fines apply to breaches of the Code under Article 166
Criminal liability: Offences in Articles 167 to 172, including unlawful processing punishable by imprisonment
Assessment route: No certification; compliance is overseen through Garante complaints, inspections and decisions
Type: Law (mandatory)
Region: Italy, EU
In OneClickComply: Supported today

Already working towards another framework?

ISO 2700128% shared
SOC 294% shared
NIST CSF50% shared
GDPR72% shared

Share of Italian Privacy Code controls covered by each framework in OneClickComply's mappings. Evidence collected once counts towards both.

Why automate

Manual Italian Privacy Code compliance vs OneClickComply

Doing it manually

Working through an Italian-language code where many articles were repealed in 2018
Duplicating GDPR work because nothing links the two sets of obligations
Chasing screenshots and exports to prove security measures are in place
Keeping processor and supplier records current in spreadsheets
Finding control gaps only when a complaint or Garante inspection arrives

With OneClickComply

Ask an Auditor gives expert guidance on Italian-specific obligations
Control mapping counts your GDPR evidence towards the Italian Privacy Code
Evidence is collected automatically from connected tools
Vendor risk management keeps processor and supplier records current
Continuous monitoring flags control drift before it becomes a finding

Capabilities

Everything you need for the Italian Privacy Code

Reuse GDPR and ISO 27001 controls against Italian Privacy Code articles
Collect security evidence automatically from 13,000+ integrations
Generate privacy, cookie and security policies with AutoComplete
Monitor security controls continuously, with alerts when they drift
Track processors and suppliers through vendor risk management
Fix supported misconfigurations with OneClickFix, logged as evidence

How it works

Three steps to Italian Privacy Code compliance

Connect and scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against the Italian Privacy Code and shows which controls pass and which fail.
Fix and generate
OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts Italian Privacy Code policies from your real environment.
Monitor and evidence
Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.

See how far your current setup is from the Italian Privacy Code.

Requirements

Italian Personal Data Protection Code (Codice Privacy) requirements

The in-force articles of the Code that set rules, rights and sanctions, with titles translated into English; repealed articles and provisions on the Garante's internal organisation are omitted.

Reference	Requirement
Art. 1	Subject matter
Art. 2	Purpose
Art. 2-bis	Supervisory authority
Art. 2-ter	Legal basis for processing in the public interest or under official authority
Art. 2-quater	Ethical rules of conduct
Art. 2-quinquies	Consent of minors to information society services
Art. 2-sexies	Special category data processed for substantial public interest
Art. 2-septies	Safeguards for genetic, biometric and health data
Art. 2-octies	Processing of criminal convictions and offences data
Art. 2-novies	Processing by the Presidency, Parliament and Constitutional Court
Art. 2-decies	Unusability of unlawfully processed data
Art. 2-undecies	Restrictions on data subject rights
Art. 2-duodecies	Restrictions for reasons of justice
Art. 2-terdecies	Rights relating to deceased persons
Art. 2-quaterdecies	Assigning tasks to designated persons
Art. 2-quaterdecies.1	Breach notification procedure for micro-enterprises
Art. 2-sexiesdecies	Data protection officer for judicial authorities
Art. 2-septiesdecies	National accreditation body
Art. 45-bis	Legal basis for Part II processing
Art. 50	News or images relating to minors
Art. 52	Identifying data in judicial decisions
Art. 58	Processing for national security or defence
Art. 59	Access to administrative documents and civic access
Art. 60	Data on health, sex life or sexual orientation
Art. 61	Use of public data and ethical rules
Art. 75	Specific conditions in the health sector
Art. 77	Simplified arrangements in healthcare
Art. 78	Information from general practitioners and paediatricians
Art. 79	Information from public and private healthcare providers
Art. 80	Information from other bodies
Art. 82	Emergencies and protection of health and safety
Art. 89-bis	Medical prescriptions
Art. 92	Medical records
Art. 93	Birth assistance certificate
Art. 96	Processing of student data
Art. 97	Scope of archiving, research and statistics provisions
Art. 99	Duration of processing
Art. 100	Study and research data
Art. 101	Processing methods for archiving
Art. 102	Ethical rules for archiving in the public interest
Art. 103	Consultation of archived documents
Art. 104	Identifying data for statistical or scientific research purposes
Art. 105	Processing methods for statistics and research
Art. 106	Ethical rules for statistical or scientific research
Art. 107	Special category data in statistics and research
Art. 108	National statistical system
Art. 109	Statistical data on births
Art. 110	Medical, biomedical and epidemiological research
Art. 110-bis	Further processing by third parties for research
Art. 111	Ethical rules for processing in employment
Art. 111-bis	Information when receiving a CV
Art. 113	Data collection and relevance in employment
Art. 114	Safeguards on remote monitoring of workers
Art. 115	Teleworking, smart working and domestic work
Art. 116	Access to data on the data subject's mandate
Art. 120	Insurance claims
Art. 121	Electronic communications services and definitions
Art. 122	Information stored in terminal equipment (cookies)
Art. 123	Traffic data
Art. 124	Itemised billing
Art. 125	Calling line identification
Art. 126	Location data
Art. 127	Nuisance and emergency calls
Art. 128	Automatic call forwarding
Art. 129	Directories of subscribers
Art. 130	Unsolicited communications
Art. 131	Information to subscribers and users
Art. 132	Retention of traffic data for other purposes
Art. 132-bis	Procedures set up by providers
Art. 132-ter	Security of processing in electronic communications
Art. 132-quater	Information about network security risks
Art. 136	Journalism and other forms of expression
Art. 137	Provisions applicable to journalism
Art. 138	Professional secrecy
Art. 139	Ethical rules for journalistic activities
Art. 140-bis	Alternative forms of redress
Art. 141	Complaint to the Garante
Art. 142	Lodging a complaint
Art. 143	Decision on a complaint
Art. 144	Reports to the Garante
Art. 144-bis	Revenge porn
Art. 152	Ordinary judicial authority
Art. 153	The Garante per la protezione dei dati personali
Art. 154	Tasks of the Garante
Art. 154-bis	Powers of the Garante
Art. 154-ter	Power to bring legal proceedings
Art. 157	Requests for information and documents
Art. 158	Inspections
Art. 159	Inspection arrangements
Art. 160	Special inspections
Art. 166	Administrative fines and corrective measures procedure
Art. 167	Unlawful processing of data
Art. 167-bis	Unlawful disclosure of data processed on a large scale
Art. 167-ter	Fraudulent acquisition of data processed on a large scale
Art. 168	False declarations to the Garante and obstruction
Art. 170	Failure to comply with Garante measures
Art. 171	Breaches of rules on remote monitoring and worker enquiries
Art. 172	Ancillary penalties

Always check the official text of the Italian Privacy Code for the exact wording.

FAQs

Italian Privacy Code questions, answered

Can't find what you need? Our in-house auditors can talk you through the Italian Privacy Code on a 30-minute call.

What is the Italian Privacy Code?

The Italian Privacy Code (Codice in materia di protezione dei dati personali, Legislative Decree 196/2003) is Italy's national data protection law. Since Legislative Decree 101/2018 it supplements the GDPR rather than replacing it, setting Italian rules on special category data, employment, healthcare, research, cookies, direct marketing, data subject complaints and criminal offences, and confirming the Garante as Italy's supervisory authority.

Who must comply with the Italian Privacy Code?

Any organisation that is subject to the GDPR and processes personal data in Italy must also follow the Italian Privacy Code. That includes Italian businesses and public bodies, and foreign companies with Italian employees, customers or website visitors. Its electronic communications rules, such as consent for cookies and marketing emails, apply to anyone targeting users in Italy.

Does the Italian Privacy Code replace the GDPR?

No. The GDPR applies directly in Italy and prevails over national law. Legislative Decree 101/2018 repealed the parts of the Code that conflicted with or duplicated the GDPR and kept national provisions where the GDPR allows member states to legislate. You therefore need to comply with both: the GDPR for core obligations and the Code for Italian specifics.

What are the penalties under the Italian Privacy Code?

Under Article 166, breaches of the Code's provisions attract the GDPR's administrative fines under Article 83, paragraphs 4 and 5, imposed by the Garante, which also orders corrective measures. Unlike the GDPR, the Code also creates criminal offences in Articles 167 to 172, including unlawful processing and fraudulent acquisition of data processed on a large scale, punishable by imprisonment.

What does the Italian Privacy Code say about cookies and marketing?

Article 122 requires the user's consent before storing or accessing information on their device, except where strictly necessary to provide a service the user requested. Article 130 requires prior consent for automated calls, email, SMS and similar marketing, while telephone and postal marketing is allowed unless the person has registered an objection in the public opt-out register.

What is the age of digital consent in Italy?

Italy's age of digital consent is 14. Under Article 2-quinquies, a minor who has turned 14 can consent to the processing of their personal data for information society services offered directly to them. For children under 14, consent must be given by a person with parental responsibility, and information addressed to minors must be written in clear, simple language.

How does the Italian Privacy Code relate to ISO 27001?

ISO 27001 is a voluntary information security standard, while the Italian Privacy Code is binding law. An ISO 27001 information security management system helps show the appropriate technical and organisational measures the GDPR requires, and supports security duties such as Article 132-ter for electronic communications providers. It does not cover Italian rules on consent, employment monitoring or marketing.

Does OneClickComply support the Italian Privacy Code?

Yes. OneClickComply supports the Italian Privacy Code today. Organisations can reuse controls and evidence from GDPR and ISO 27001 work, collect evidence automatically from connected tools, generate privacy policies from their real environment, and get guidance from our in-house audit team through Ask an Auditor.

Related frameworks

All frameworks

Products

Start working towards the Italian Privacy Code

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.

Meet the Italian Privacy Code alongside your GDPR controls

Is the Italian Privacy Code right for your organisation?

How OneClickComply helps with the Italian Privacy Code

Manual Italian Privacy Code compliance vs OneClickComply

Everything you need for the Italian Privacy Code

Three steps to Italian Privacy Code compliance

Connect and scan

Fix and generate

Monitor and evidence