Italy

Layer 1 is the General Data Protection Regulation, Articles 3 and 27. Layer 2 is Italy's own Personal Data Protection Code, Legislative Decree 196/2003 as rewritten by Legislative Decree 101/2018, which keeps a set of national rules that sit alongside the European ones: employment and workplace monitoring, the age of consent for children, the data of deceased people, telecoms traffic data, and a set of criminal offences. Those national rules bite on anyone processing data in Italy, including foreign controllers acting through an Italian establishment or targeting the Italian market. Public-sector procurement adds a third layer that is contractual and technical rather than data-protection law: a cloud service cannot be sold to an Italian public body at all unless the National Cybersecurity Agency has qualified it.

Sector by sector, checked 18 August 2026. GOVERNMENT AND PUBLIC SECTOR — data must stay in the country for strategic data, data can leave once conditions are met (Europe only) for critical data. The Cloud Italia strategy defines strategic data as data whose compromise would affect national security, critical data as data whose compromise would damage functions important to society, and ordinary data as everything else. Strategic workloads go to a private or hybrid cloud based in Italy with Italian operational management, or to the National Strategic Hub; critical workloads must avoid non-European public cloud; ordinary workloads may use any European-qualified public cloud. The National Strategic Hub is explicitly designed to be "autonomi da soggetti extra UE" — independent of non-European entities. Separately, any cloud service sold to a public administration must first be qualified by the National Cybersecurity Agency under its single cloud regulation, adopted 27 June 2024, with the ordinary qualification regime running from August 2024. HEALTH — data can leave once conditions are met in the private sector, but public health bodies are public administrations and inherit the rules above, so in practice hospital and regional health workloads sit on European or Italian infrastructure. Health records also flow into a national infrastructure: the Electronic Health Record 2.0 built on the National Interoperability Infrastructure and the Health Data Ecosystem, governed by the Health Ministry decree of 7 September 2023 and the Health Data Ecosystem decree of 31 December 2024. TELECOMS — conditional No storage-location rule found, checked 18 August 2026, but a heavy retention floor applies: telephone traffic data 24 months, internet traffic data 12 months, unanswered calls 30 days, and a separate 72-month regime for terrorism and serious crime. BANKING, PAYMENTS, SECURITIES, INSURANCE — open No localisation rule found, checked 18 August 2026. The Bank of Italy has confirmed that its earlier sectoral prohibitions on outsourcing no longer apply to technology services supporting essential or important functions; the European financial resilience regulation replaced them with a notification duty from 17 January 2025 and imposes no data-residency requirement. DEFENCE AND CRITICAL INFRASTRUCTURE — data can leave once conditions are met and government-controlled. Entities inside the National Cybersecurity Perimeter must tell the national vetting centre before they buy technology goods, systems or services for their most sensitive assets, and the government can attach conditions. ARTIFICIAL INTELLIGENCE — open A clause requiring public-sector artificial intelligence systems to be installed on servers located in Italy was in the bill and was struck out in committee before the law passed. It is not law. MAPPING AND GEOSPATIAL, EDUCATION, E-COMMERCE — no localisation rule found, checked 18 August 2026, confidence medium. ONLINE GAMING — not confirmed. See the unconfirmed list.

The model is an allowlist with contractual escape hatches. The approved list, verified on the Commission's own page on 18 August 2026, has 17 entries: Andorra, Argentina, Brazil (added 26 January 2026), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States but only for companies self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. Nothing has been withdrawn or suspended. The 2021 standard contractual clauses remain the operative set. The promised new clauses for recipients already directly subject to European law had still not been adopted on 18 August 2026. Narrow one-off exceptions exist — explicit consent, contract necessity, legal claims — but they are not for routine or bulk flows. The Italian addition is Article 167(2) of the Personal Data Protection Code, which makes an unlawful transfer of personal data out of Europe a crime rather than an administrative matter.

The Garante's board is elected by Parliament and normally has four members. One member, Guido Scorza, resigned on 19 January 2026 after a period of political controversy over the authority's independence; the authority's own board page records his term as ending on that date, and as of 18 August 2026 no replacement had been reported as elected. The remaining three members continue to operate and the authority has continued to publish decisions throughout 2026, including its annual report on 2 July 2026. The board's seven-year term, which began on 29 July 2020, runs to 2027. Cybersecurity, the national cyber perimeter, the network and information security regime and cloud qualification for public bodies sit with the National Cybersecurity Agency, which is fully operational and issuing binding determinations. Financial firms answer to the Bank of Italy under the European financial resilience regime; telecoms are supervised by the communications authority. Rating: aggressive. The Garante goes looking rather than waiting for complaints, and it uses processing-suspension orders, which hurt more than the fines.

Floors. Article 132 of the Personal Data Protection Code sets 24 months for telephone traffic data, 12 months for telematic traffic data excluding message content, and 30 days for unanswered calls, all for criminal-investigation purposes. Article 132(5-bis) preserves Article 24 of Law 167/2017, which extends retention to 72 months for terrorism and certain serious offences. Access to any of it requires a reasoned judicial order following the 2021 reform. Ordinary commercial and accounting records are generally kept ten years under the Civil Code — see the unconfirmed list, this was not re-verified in this run. Health: records in the Electronic Health Record are deleted 30 years after death, on an annual cycle. Ceilings. General European law says do not keep personal data longer than you need it. Italy's sharpest specific ceiling is the Garante's June 2024 guidance on workplace email, which says metadata may normally be retained "per un periodo limitato a pochi giorni, comunque non superiore ai 21 giorni". In April 2025 the Garante applied it against a regional government that had kept 90 days of metadata. Conflict. Where a legal duty to keep collides with a duty to delete, the retention duty wins for the narrow purpose that requires it, but the data must be locked down and used for nothing else.

Clock one: General Data Protection Regulation Articles 33 and 34 — 72 hours to the Garante, and notification to individuals without undue delay where the risk is high. The Garante received 2,415 breach notifications in 2025, up about ten per cent on 2024. Clock two: the Italian network and information security decree, Legislative Decree 138/2024, implementing the European NIS2 directive. Registration opened on 1 December 2024 with an annual renewal window of 1 January to 28 February. Incident notification obligations became operative on 15 January 2026 under a National Cybersecurity Agency determination: early warning within 24 hours of becoming aware, notification within 72 hours, final report within one month. Basic security measures must be in place by 31 October 2026. These dates come from professional commentary because the agency's own site refused automated fetching — see the unconfirmed list. Clock three: the National Cybersecurity Perimeter, set up by Decree-Law 105/2019 with implementing decrees 131/2020 and 81/2021. Designated public and private entities in strategic sectors must report incidents very fast — six hours is the figure in circulation — and must notify the national vetting centre before buying technology for their most sensitive systems. Clock four, for financial firms only: the European financial resilience regime, reported to the Bank of Italy through its Infostat channel rather than to the cyber agency.

1. Workplace email metadata. The Garante's June 2024 guidance limits retention of email system metadata to a few days and normally no more than 21. It applied this in April 2025 against Regione Lombardia, which had kept 90 days. This catches almost every standard corporate email platform in its default configuration. 2. Employee monitoring. Article 4 of the Workers' Statute, Law 300/1970, carried into data protection law by Article 114 of the Personal Data Protection Code, requires a trade-union agreement or an authorisation from the labour inspectorate before installing equipment from which remote monitoring of workers could result. Breach is punishable criminally. A standard data protection impact assessment does not substitute for it. 3. Criminal, not administrative. The Personal Data Protection Code keeps criminal offences: Article 167 for unlawful processing including unlawful transfer of personal data abroad, and Article 167-bis for unlawful communication or dissemination of personal data on a large scale. These attach to individuals, not only to companies. The exact prison terms were not verified in this run — see the unconfirmed list. 4. Children. Italy set the age of valid consent for online services at 14 under Article 2-quinquies, where the European default is 16 and many neighbours chose 13 or 16. Age-gating built to a 16 rule is over-restrictive in Italy; one built to 13 is unlawful. 5. Deceased people. Under Article 2-terdecies, the rights of a dead person's data can be exercised by people with an interest, by family members, or by someone acting to protect them. Most deletion workflows assume rights end at death. In Italy they do not. 6. The artificial intelligence rule that is not a rule. A clause requiring public-sector artificial intelligence systems to be installed on servers in Italy passed the Senate and was struck out in committee in the Chamber. The Chamber's own record marks it "Soppresso". It is not in the law that took effect on 10 October 2025, but it is still repeated as if it were.

Landing in the next twelve months. 31 October 2026: basic security measures deadline under the Italian network and information security decree, after which the national cyber agency shifts from hand-holding to audits and inspections. Around October 2026: the twelve-month window for the government to issue the delegated decrees under the artificial intelligence law, which took effect on 10 October 2025, expires — these decrees will decide much of what the law actually means. 12 January 2027: cloud switching charges and data egress fees must be zero across Europe under the Data Act. 2027: the Garante board's seven-year term ends. Live risk. The EU-US Data Privacy Framework was still in force and valid on 18 August 2026, but on 31 July 2026 Europe's data protection board formally asked the Commission to examine whether it is still sound after a US Supreme Court decision on the independence of the US enforcement agency, and a separate appeal is pending before Europe's top court. If it falls, every transfer relying on it moves to standard contracts overnight. DORMANT SWITCHES — powers already held, usable without consultation. First, golden power: under Decree-Law 21/2012 the government must be notified of contracts for fifth-generation mobile network goods and services and can impose binding conditions, expressly to protect Italian know-how, cybersecurity and data — storage location can be one of those conditions, decided case by case and not published in advance. Second, the National Cybersecurity Perimeter: ministries propose and the cyber agency maintains the list of entities inside it, so an organisation can be pulled into a much stricter regime by administrative act. Third, cloud qualification: the national cyber agency grants, and can withdraw, the qualification without which a provider cannot sell to any Italian public body. Fourth, reclassification: moving a public service from ordinary to critical or strategic changes where its data may sit, with no change in the law at all.