Italy

There are three layers. Layer 1 is the General Data Protection Regulation, Articles 3 and 27. Layer 2 is Italy's own Personal Data Protection Code, Legislative Decree 196/2003, as rewritten by Legislative Decree 101/2018. It keeps a set of national rules that sit alongside the European ones. They cover employment and workplace monitoring, the age of consent for children, the data of dead people, telecoms traffic data, and a set of crimes. Those national rules apply to anyone who uses or stores data in Italy. That includes foreign companies acting through an Italian office or targeting the Italian market. Layer 3 comes from public-sector buying rules. It is contractual and technical rather than data protection law. A cloud service cannot be sold to an Italian public body at all unless the National Cybersecurity Agency has approved it.

Here is each industry, checked 18 August 2026. GOVERNMENT AND PUBLIC SECTOR. Closed for strategic data (data must stay in the country). Europe only for critical data (data can leave only if conditions are met). The Cloud Italia strategy defines strategic data as data whose loss would affect national security. Critical data is data whose loss would damage functions important to society. Ordinary data is everything else. Strategic work goes to a private or hybrid cloud based in Italy and managed from Italy, or to the National Strategic Hub. Critical work must avoid public cloud outside Europe. Ordinary work may use any European-approved public cloud. The National Strategic Hub is designed to be "autonomi da soggetti extra UE", meaning independent of bodies outside Europe. Separately, any cloud service sold to a public body must first be approved by the National Cybersecurity Agency. That runs under its single cloud rules, adopted 27 June 2024. The ordinary approval process has run since August 2024. HEALTH. Conditional in the private sector (data can leave only if conditions are met). Public health bodies are public administrations, so they follow the rules above. So hospital and regional health systems sit on European or Italian infrastructure. Health records also flow into a national system. That is the Electronic Health Record 2.0, built on the National Interoperability Infrastructure and the Health Data Ecosystem. It is governed by the Health Ministry decree of 7 September 2023 and the Health Data Ecosystem decree of 31 December 2024. TELECOMS. Conditional (data can leave only if conditions are met). We found no rule about where data must be stored, checked 18 August 2026. But you must keep records for a long time. Telephone traffic data runs 24 months. Internet traffic data runs 12 months. Unanswered calls run 30 days. A separate 72-month rule covers terrorism and serious crime. BANKING, PAYMENTS, SECURITIES, INSURANCE. Open (data can leave freely). We found no rule requiring data to stay in the country, checked 18 August 2026. The Bank of Italy has confirmed that its earlier bans on outsourcing no longer apply to technology services supporting essential or important functions. The European financial resilience regulation replaced them with a duty to notify, from 17 January 2025. It does not require data to stay in any particular country. DEFENCE AND CRITICAL INFRASTRUCTURE. Conditional and government-controlled (data can leave only if conditions are met). Organisations inside the National Cybersecurity Perimeter must tell the national vetting centre before they buy technology goods, systems or services for their most sensitive assets. The government can attach conditions. ARTIFICIAL INTELLIGENCE. Open (data can leave freely). A clause requiring public-sector artificial intelligence systems to be installed on servers in Italy was in the bill. It was struck out in committee before the law passed. It is not law. MAPPING AND GEOSPATIAL, EDUCATION, E-COMMERCE. We found no rule requiring data to stay in the country, checked 18 August 2026, confidence medium. ONLINE GAMING. Not confirmed. See the unconfirmed list.

You may only send data to approved countries, with contracts as a fallback. We checked the approved list on the Commission's own page on 18 August 2026. It has 17 entries. Andorra, Argentina, Brazil (added 26 January 2026), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States but only for companies self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. Nothing has been withdrawn or suspended. The 2021 standard contractual clauses are still the ones to use. Europe promised new clauses for receivers already directly covered by European law. Those had still not been adopted on 18 August 2026. There are narrow one-off exceptions, such as explicit consent, need to perform a contract, or legal claims. They are not for routine or bulk transfers. Italy adds Article 167(2) of the Personal Data Protection Code. It makes an unlawful transfer of personal data out of Europe a crime rather than an administrative matter.

Parliament elects the Garante's board, which normally has four members. One member, Guido Scorza, resigned on 19 January 2026. That followed a period of political argument over the authority's independence. The authority's own board page records his term as ending on that date. As at 18 August 2026 no replacement had been reported as elected. The remaining three members carry on. The authority has published decisions throughout 2026, including its annual report on 2 July 2026. The board's seven-year term began on 29 July 2020 and runs to 2027. The National Cybersecurity Agency handles cybersecurity, the national cyber perimeter, network and information security rules, and cloud approval for public bodies. It is fully up and running and issues binding decisions. Financial firms answer to the Bank of Italy under the European financial resilience rules. The communications authority supervises telecoms. We rate the Garante aggressive. It goes looking rather than waiting for complaints. It uses orders to stop using data, which hurt more than the fines.

Minimum keeping times. Article 132 of the Personal Data Protection Code sets 24 months for telephone traffic data. It sets 12 months for internet traffic data, not counting the content of messages. It sets 30 days for unanswered calls. All of this is for criminal investigations. Article 132(5-bis) keeps Article 24 of Law 167/2017 alive. That extends the period to 72 months for terrorism and certain serious crimes. Since the 2021 reform, reading any of it needs a reasoned order from a judge. Ordinary commercial and accounting records are generally kept ten years under the Civil Code. See the unconfirmed list, as we did not re-check this. Health records in the Electronic Health Record are deleted 30 years after death, on an annual cycle. Maximum keeping times. General European law says do not keep personal data longer than you need it. Italy's sharpest specific limit is the Garante's June 2024 guidance on workplace email. It says the technical logs may normally be kept "per un periodo limitato a pochi giorni, comunque non superiore ai 21 giorni". That means a few days at most, and never more than 21. In April 2025 the Garante used it against a regional government that had kept 90 days of those logs. When they clash. Where a legal duty to keep runs into a duty to delete, the duty to keep wins for the narrow purpose that requires it. But you must lock the data down and use it for nothing else.

Deadline one. General Data Protection Regulation Articles 33 and 34. You have 72 hours to tell the Garante. You must tell the people affected without undue delay where the risk is high. The Garante received 2,415 breach notifications in 2025, up about ten per cent on 2024. Deadline two. The Italian network and information security decree, Legislative Decree 138/2024. It puts the European NIS2 directive into Italian law. Registration opened on 1 December 2024, with an annual renewal window of 1 January to 28 February. Incident reporting duties started on 15 January 2026 under a National Cybersecurity Agency decision. You must send an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within one month. Basic security measures must be in place by 31 October 2026. These dates come from professional commentary, because the agency's own site refused automated fetching. See the unconfirmed list. Deadline three. The National Cybersecurity Perimeter, set up by Decree-Law 105/2019, with decrees 131/2020 and 81/2021 filling in the detail. Named public and private bodies in strategic industries must report incidents very fast. Six hours is the figure in circulation. They must also tell the national vetting centre before buying technology for their most sensitive systems. Deadline four, for financial firms only. The European financial resilience rules. You report to the Bank of Italy through its Infostat channel, not to the cyber agency.

1. Workplace email logs. The Garante's June 2024 guidance limits how long you keep the technical logs behind email. It says a few days, and normally no more than 21. It applied this in April 2025 against Regione Lombardia, which had kept 90 days. Almost every standard corporate email platform breaks this in its default setup. 2. Employee monitoring. Article 4 of the Workers' Statute, Law 300/1970, carried into data protection law by Article 114 of the Personal Data Protection Code. You need a trade-union agreement, or permission from the labour inspectorate, before installing equipment that could let you monitor workers remotely. Breaking this is a crime. A standard data protection impact assessment is not a substitute. 3. Crimes, not just fines. The Personal Data Protection Code keeps some crimes alive. Article 167 covers unlawful use of data, including unlawfully sending personal data abroad. Article 167-bis covers unlawfully sharing or publishing personal data on a large scale. These attach to individuals, not only to companies. We did not confirm the exact prison terms. See the unconfirmed list. 4. Children. Italy set the age of valid consent for online services at 14, under Article 2-quinquies. The European default is 16, and many neighbours chose 13 or 16. An age check built to a 16 rule is too strict in Italy. One built to 13 is unlawful. 5. Dead people. Under Article 2-terdecies, someone else can exercise the rights over a dead person's data. That can be people with an interest, family members, or someone acting to protect them. Most deletion workflows assume rights end at death. In Italy they do not. 6. The artificial intelligence rule that is not a rule. A clause requiring public-sector artificial intelligence systems to be installed on servers in Italy passed the Senate. It was struck out in committee in the Chamber. The Chamber's own record marks it "Soppresso". It is not in the law that took effect on 10 October 2025. It is still repeated as if it were.

Landing in the next twelve months. 31 October 2026: the deadline for basic security measures under the Italian network and information security decree. After that the national cyber agency moves from helping to auditing and inspecting. Around October 2026: the twelve-month window for the government to issue the follow-up decrees under the artificial intelligence law expires. That law took effect on 10 October 2025. Those decrees will decide much of what it actually means. 12 January 2027: across Europe, cloud switching charges and charges for pulling your data out must be zero, under the Data Act. 2027: the Garante board's seven-year term ends. Live risk. The EU-US Data Privacy Framework was still in force and valid on 18 August 2026. On 31 July 2026 Europe's data protection board formally asked the Commission to examine whether it is still sound. That followed a United States Supreme Court decision on the independence of the United States enforcement agency. A separate appeal is pending before Europe's top court. If it falls, every transfer relying on it moves to standard contracts overnight. FOUR CHANGES THE GOVERNMENT CAN MAKE WITHOUT CONSULTATION. First, golden power. Under Decree-Law 21/2012 you must notify the government of contracts for fifth-generation mobile network goods and services. It can impose binding conditions, to protect Italian know-how, cybersecurity and data. Where data is stored can be one of those conditions. It is decided case by case and not published in advance. Second, the National Cybersecurity Perimeter. Ministries propose the list of bodies inside it and the cyber agency maintains it. So an organisation can be pulled into much stricter rules by an administrative act. Third, cloud approval. The national cyber agency grants the approval a provider needs to sell to any Italian public body, and it can withdraw it. Fourth, regrading. Moving a public service from ordinary to critical or strategic changes where its data may sit, with no change in the law at all.