---
title: "Italy — Cross-Border & Adequacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/italy/cross-border-and-adequacy/
source_html: /jurisdictions/italy/cross-border-and-adequacy/index.html
description: "Italy — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 2 claims Green ▾ # Transfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific l"
generated_at: 2026-10-25T04:46:50Z
content_sha256: b12d1f5f887f7c5bdb0505de501c000bbc11a9bc906dcdc49bca94fdf9caa12f
generator: "fe-fleet/md-twin@1.0"
---
# Italy — Cross-Border & Adequacy | Data Protection Monitor

### D5Cross-Border & Adequacy6 sub-modules2 claimsGreen▾#

Transfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific localisation barrier identified for AI systems.

Primary framework GDPR Arts. 44-49 (directly applicable EU Regulation)

Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/)

Traffic-light rationale — Green Transfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific localisation barrier identified for AI systems.

#### Sub-modules (6)

#### Transfer MechanismsGreen

SCCs, BCRs, adequacy decisions and Art.49 derogations apply directly in Italy as components of the directly-applicable GDPR.

Claims (1):

- As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.

#### Adequacy ReceivedGreen

Adequacy determinations are an EU Commission competence under Art.45 GDPR, not a discrete Italian national act; no IT-specific 'received' adequacy instrument exists.

Absence provenance: Adequacy is adopted centrally by the European Commission and binds all Member States uniformly; no separate Italian determination exists.. Searched: Italy national adequacy decision GDPR.

#### Adequacy GrantedGreen

As with 'received' adequacy, 'granted' adequacy decisions are issued by the European Commission (Art.45), not by Italy individually.

Absence provenance: No Italy-specific adequacy-granting instrument exists; competence sits with the European Commission.. Searched: Italy grants adequacy third country.

#### Sccs And BcrsGreen

The Garante participates in the EU one-stop-shop mechanism for BCR approval of Italian corporate groups and applies EU Commission SCCs directly.

Claims (1):

- As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.

#### Transfer Impact AssessmentGreen

TIA obligations flow from EDPB/EU jurisprudence (Schrems II) and apply directly in Italy as part of the GDPR Art.46 framework.

Claims (1):

- As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.

#### Data LocalisationGreen

Italy's 2025 AI Law confirms the possibility of installing AI systems on servers located outside the EU for both public and private use, indicating no general data-localisation mandate for AI-related processing.

Claims (1):

- The final text of Italy's AI Law confirms the possibility of installing AI systems on servers located outside the EU for both public and private use, ensuring continuity in cloud-infrastructure use while upholding data-protection and security standards.

Category narrative 66 words

As an EU Member State, Italy applies GDPR Chapter V (Arts.44-49) transfer mechanisms directly and uniformly; adequacy decisions are an EU Commission competence exercised at Union level rather than a discrete Italian instrument, so IT-specific 'adequacy received/granted' determinations do not exist as separate national acts. Italy's new AI Law (L.132/2025) expressly permits installing AI systems on non-EU servers, indicating no blanket data-localisation mandate for AI processing.

Evidence 2

Sources and claims (2)
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en) — As GDPR is directly applicable EU law in Italy, Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art.49 derogations) apply uniformly without a separate Italian transposition act.observed 2026-08-03
- Confirmed[IAPP](https://iapp.org/news/a/italy-becomes-first-eu-member-state-to-pass-an-ai-law) — The final text of Italy's AI Law confirms the possibility of installing AI systems on servers located outside the EU for both public and private use, ensuring continuity in cloud-infrastructure use while upholding data-protection and security standards.observed 2026-08-03