Data Protection Monitor
Global Privacy & Data Protection Intelligence

Italy (IT) · Module Detail

Italy: Cross-Border & Adequacy

← Full Italy overview Build report with Italy Request deeper dive

#

Transfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific localisation barrier identified for AI systems.

Primary frameworkGDPR Arts. 44-49 (directly applicable EU Regulation)
Supervisory authorityGarante per la protezione dei dati personali
Traffic-light rationale — GreenTransfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific localisation barrier identified for AI systems.

Sub-modules (6)

Transfer MechanismsGreen

SCCs, BCRs, adequacy decisions and Art.49 derogations apply directly in Italy as components of the directly-applicable GDPR.

Claims (1):

  • As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.

Adequacy ReceivedGreen

Adequacy determinations are an EU Commission competence under Art.45 GDPR, not a discrete Italian national act; no IT-specific 'received' adequacy instrument exists.

Absence provenance: Adequacy is adopted centrally by the European Commission and binds all Member States uniformly; no separate Italian determination exists.. Searched: Italy national adequacy decision GDPR.

Adequacy GrantedGreen

As with 'received' adequacy, 'granted' adequacy decisions are issued by the European Commission (Art.45), not by Italy individually.

Absence provenance: No Italy-specific adequacy-granting instrument exists; competence sits with the European Commission.. Searched: Italy grants adequacy third country.

Sccs And BcrsGreen

The Garante participates in the EU one-stop-shop mechanism for BCR approval of Italian corporate groups and applies EU Commission SCCs directly.

Claims (1):

  • As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.

Transfer Impact AssessmentGreen

TIA obligations flow from EDPB/EU jurisprudence (Schrems II) and apply directly in Italy as part of the GDPR Art.46 framework.

Claims (1):

  • As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.

Data LocalisationGreen

Italy's 2025 AI Law confirms the possibility of installing AI systems on servers located outside the EU for both public and private use, indicating no general data-localisation mandate for AI-related processing.

Claims (1):

  • The final text of Italy's AI Law confirms the possibility of installing AI systems on servers located outside the EU for both public and private use, ensuring continuity in cloud-infrastructure use while upholding data-protection and security standards.
Category narrative66 words

As an EU Member State, Italy applies GDPR Chapter V (Arts.44-49) transfer mechanisms directly and uniformly; adequacy decisions are an EU Commission competence exercised at Union level rather than a discrete Italian instrument, so IT-specific 'adequacy received/granted' determinations do not exist as separate national acts. Italy's new AI Law (L.132/2025) expressly permits installing AI systems on non-EU servers, indicating no blanket data-localisation mandate for AI processing.

Sources and claims (2)
  1. ConfirmedGarante Privacy — As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.observed
  2. ConfirmedIAPP — The final text of Italy's AI Law confirms the possibility of installing AI systems on servers located outside the EU for both public and private use, ensuring continuity in cloud-infrastructure use while upholding data-protection and security standards.observed