--- title: "Italy Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/italy-data-protection-privacy-regulation/ source_html: /jurisdictions/italy/index.html description: "Italy data protection and privacy regulation: 10 categories, 103 claims, updated 2026-11-03. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: d344e66f10e65d7a4391490c1ebd0b3f7e732043fd6eb23d1ba766b614c63b88 generator: "fe-fleet/md-twin@1.0" --- # Italy Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-03 · 10 categories · 103 claims · 109 sources in the cumulative register Download report (PDF) Expand all The Garante's decision of 17 April 2026 to fine Poste Italiane EUR 6,624,000 and PostePay EUR 5,877,000 — a combined EUR 12.5 million — over device-surveillance software development kits embedded in the companies' banking applications is the dominant enforcement event of this cycle. Data collected 2026-11-02 · Data published 2026-11-03 AI-assembled from cited sources Not fully checked this cycle: Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-03 · Position last changed: 2026-11-03 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ITALY)[Build Report](/reports/?j=ITALY)[Compare](/compare/?j=ITALY) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Garante per la protezione dei dati personali Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 103 Claims 23 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No red categories; 2 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Italy is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Italy’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 917 Full executive summary 284 ###### Latest update · 25 October 2026 #### Lead Signal Italy's data-protection and AI-governance architecture moved decisively this period with the entry into force, on 23 October 2026, of Legislative Decree no. 179 of 7 October 2026, which designates AgID and ACN as the country's national AI Act authorities and assigns supervision of high-risk AI systems used in banking and financial services to Banca d'Italia, in investment services to CONSOB, and in insurance to IVASS, each acting within its pre-existing sectoral competence. The decree's design preserves the Garante's independent data-protection competence over AI systems as a matter distinct from sectoral AI Act supervision, settling an institutional question that had stood open since the EU AI Act's entry into application. #### Other Developments The Garante fined IQVIA Solutions Italy Srl EUR 7 million by Provvedimento n. 710 of 6 October 2026, rejecting the company's claim that health data on approximately one million patients had been anonymised. The Garante found that a persistent per-patient code retained in the processing enabled re-identification, and held the processing to violate GDPR Articles 5, 9, 13, 25, 28, 32 and 35. The decision reinforces a strict reading of the anonymisation standard against pseudonymisation dressed as anonymisation, particularly in the health-data context. A six-month compliance deadline under the Garante's email tracking-pixel guidelines, Provvedimento n. 284 of 2026, falls due on 29 October 2026. The guidelines require prior, free, specific and informed opt-in consent before any email tracking pixel that identifies the recipient on open may be deployed, with a narrow exception for deliverability, security and institutional-communication purposes. Organisations sending tracked commercial email into Italy face that deadline within days of this period's close. #### Cross-Monitor Connections The AI Act supervisory architecture fixed by Legislative Decree 179/2026 is directly relevant to the financial-services and payments monitors, which separately track Banca d'Italia's, CONSOB's and IVASS's expanded sectoral mandates for high-risk AI oversight in banking, investment and insurance activity respectively. The Garante's enforcement posture on anonymisation, illustrated by the IQVIA fine, is also relevant to any commercial-privacy or health-data processing tracked under adjacent sectoral monitors. #### Outlook The near-term compliance deadline to watch is 29 October 2026, when the email tracking-pixel consent requirement under Provvedimento 284/2026 takes full effect; organisations relying on open-tracking pixels for commercial email into Italy should expect the narrow deliverability/security/institutional exception to be read strictly. On the institutional side, the AI Act supervisory split fixed by Legislative Decree 179/2026 is now settled law, but its full text has not yet been independently retrieved, so the precise boundaries between the Garante's residual data-protection competence and the sectoral AI Act supervisors named in the decree remain to be tested in practice as enforcement activity develops. 4 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Garante's decision of 17 April 2026 to fine Poste Italiane EUR 6,624,000 and PostePay EUR 5,877,000 — a combined EUR 12.5 million — over device-surveillance software development kits embedded in the companies' banking applications is the dominant enforcement event of this cycle. The Garante found violations across GDPR Articles 5, 6, 13, 25, 26, 28, 32 and 35, together with Article 122 of the Italian Privacy Code, and explicitly rejected Poste Italiane's argument that PSD2 fraud-prevention obligations justified the intrusive processing, finding that less invasive alternatives existed. The decision sets a financial-sector precedent that PSD2-based fraud-prevention justifications do not automatically legitimise device-level surveillance under GDPR. #### Other Developments Judicial reversal of the OpenAI fine. The Court of Rome annulled, on 18 March 2026, the Garante's EUR 15 million fine originally imposed against OpenAI on 20 December 2024, a landmark reversal that signals judicial pushback against the regulator's AI-enforcement approach and introduces new uncertainty into how far the Garante's AI-related GDPR enforcement will be sustained on appeal. Character.AI fined over privacy and child-protection lapses. The Garante fined Character Technologies Inc. approximately EUR 158,000 for privacy and child-protection lapses, a decision that also implicates age-verification failures in a generative-AI chatbot context and sets an early marker for scrutiny of interactive AI platforms used by minors. New opt-in rules for email tracking pixels. In April 2026 the Garante introduced guidelines requiring email tracking pixels to move to an opt-in consent model, with a six-month compliance window for businesses to adjust, placing a concrete compliance deadline on the adtech and commercial-privacy landscape. #### Cross-Monitor Connections The Poste Italiane/PostePay decision's rejection of a PSD2-based justification for device surveillance is directly relevant to the world-payments monitor's conduct and safeguarding coverage, given the decision concerns banking-application security tooling deployed by a licensed payment-services provider. The Character.AI and OpenAI enforcement actions are relevant to the artificial-intelligence monitor's coverage of generative-AI governance in Italy, particularly on the question of how durable Garante enforcement against AI providers proves to be following the Court of Rome's reversal. #### Outlook Two threads are worth tracking into the next cycle: whether the Garante appeals the Court of Rome's annulment of the OpenAI fine, which would clarify whether this cycle's reversal is a one-off procedural correction or a more durable check on the regulator's AI-enforcement approach; and whether Poste Italiane and PostePay's appeal of the EUR 12.5 million fine succeeds in disturbing the Garante's rejection of the PSD2 fraud-prevention defence, a precedent that other financial-sector controllers deploying similar device-surveillance tooling will be watching closely. The six-month compliance window for the new email-tracking-pixel opt-in rules, running to around October 2026, is a concrete near-term deadline for adtech-adjacent controllers operating in Italy. Read full brief · 917 words ###### Latest update · 18 October 2026 #### Regulatory Status Italy's data-protection enforcement activity this cycle centres on the Garante's continuing application of the essentiality-of-information principle in the Garlasco case, with a 9,380-euro fine against Cairo Editore (provvedimento n.759, 23 September 2026) following an earlier RTI fine. Two forward-looking compliance deadlines are live: the Garante's tracking-pixel guidelines compliance date of 29 October 2026, affecting businesses, platforms and newsletter operators using pixel-based tracking; and the EU Data Act's cloud-switching-fee prohibition taking full effect 12 January 2027 under Article 29 of Regulation (EU) 2023/2854, for which Italy's national competent authority designation remains unconfirmed. #### Outlook Watch for continued Garante enforcement on the Garlasco case pattern, market conformity rates ahead of the 29 October 2026 tracking-pixel deadline, and whether Italy designates a Data Act national competent authority before the 12 January 2027 cloud-switching prohibition takes full effect. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Italy's data-protection enforcement activity was unusually dense this cycle, anchored by the Garante's EUR 12.5 million combined fine against Poste Italiane and PostePay over device-surveillance banking-app SDKs, in which the regulator rejected a PSD2 fraud-prevention justification. The Court of Rome separately annulled the Garante's EUR 15 million OpenAI fine, and the Garante fined Character.AI approximately EUR 158,000 over privacy and child-protection lapses. New opt-in rules for email tracking pixels, with a six-month compliance window, add a concrete adtech deadline. Italy's AI Law also introduced a health-data secondary-use carve-out for AI research subject to Garante notification. #### Outlook Watch the Poste Italiane/PostePay appeal, any Garante appeal of the Court of Rome's OpenAI reversal, and the October 2026 email-tracking-pixel compliance deadline. Read full brief · 284 words Key regulatory facts for Italy Regulatory Dimension Italy Standing Position Jurisdiction Italy (IT) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 103 sourced findings) Regulator & Framework Mature, fully-operational omnibus regime with an active, well-resourced supervisory authority and dense enforcement caseload. Lawful Processing & Special Data Core lawful-basis and special-category doctrine is settled and actively enforced; anonymisation-specific guidance coverage is thinner. Data Subject Rights Rights framework is GDPR-aligned and actively enforced with concrete recent case law on response deadlines and opposition rights. Controller/Processor Duties Framework is GDPR-aligned and enforced robustly, but repeated large fines for DPIA/retention/security gaps (Poste Italiane, public-sector breaches) indicate ongoing compliance friction. Primary Instruments Cited Garante Privacy, Garante Privacy, Garante Privacy, Garante Privacy, SimplyBiz Last Confirmed / Updated 2026-11-03 (109 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Italy: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Mature, fully-operational omnibus regime with an active, well-resourced supervisory authority and dense enforcement caseload. Primary framework GDPR (Regulation (EU) 2016/679) + Codice in materia di protezione dei dati personali (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018) Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green Mature, fully-operational omnibus regime with an active, well-resourced supervisory authority and dense enforcement caseload. #### Sub-modules (5) #### Regulator And AuthorityGreen The Garante is Italy's independent DPA, based only in Rome, designated GDPR Art.51 supervisory authority. Claims (5): - The Garante per la protezione dei dati personali is Italy's independent administrative authority, established by Law No. 675/1996 and subsequently regulated by the Codice Privacy, designated as GDPR Art.51 supervisory authority and based only in Rome. - D.Lgs. 7 ottobre 2026, n. 179 — Designates AgID and ACN as Italy's national AI Act authorities and assigns supervision of high-risk AI systems used in banking/financial services to Banca d'Italia, in investment services to CONSOB, and in insurance to IVASS, each within its pre-existing sectoral competence. - Garante per la protezione dei dati personali — Sole national DPA, historically one of the EU's most active enforcers. - D.Lgs.196/2003 — Garante per la protezione dei dati personali designated as GDPR Art 51 supervisory authority - Legge 132/2025 Art 20 — AgID = AI Act Art 70 notifying authority; ACN = market surveillance/EU contact point/inspection & sanctioning authority; Garante retains GDPR/Codice Privacy enforcement #### Act And InstrumentsGreen GDPR applies directly; Codice Privacy (D.Lgs.196/2003) as amended by D.Lgs.101/2018 is the national implementing/adapting act. Claims (2): - GDPR (Regulation (EU) 2016/679) applies directly in Italy and is implemented/adapted via the Codice Privacy (D.Lgs. 196/2003) as amended by D.Lgs. 101/2018. - D.Lgs.196/2003 — Codice Privacy coordinated text last amended 19 February 2026 (D.L. 19/2026 converted) following L.182/2025 and D.Lgs.215/2025 #### Material ScopeGreen Material scope follows GDPR directly as an EU Regulation; Codice provisions (e.g. 2-septies, 2-decies) supplement special-category and remedies rules. Claims (1): - Garante decisions consistently apply GDPR material-scope concepts (Art.4(2) processing, including dissemination) requiring a lawful basis for any processing operation under Italian law. #### Territorial ScopeGreen GDPR Art.3 territorial scope applies uniformly in Italy as directly-applicable EU law; non-EU providers (e.g. Character Technologies/US) have been pursued by the Garante including EU-representative designation failures. Claims (1): - The Garante exercised jurisdiction over Character Technologies Inc. (a US company operating Character.AI), citing among other violations a delayed designation of its EU representative, confirming extraterritorial application of GDPR to non-EU controllers targeting Italian users. #### Regulator Registration And FilingAmber No general controller registration regime; residual duty to notify the Garante of DPO data changes, breach of which has been separately sanctioned. Claims (1): - A public-sector controller (Comune di Mirabella Imbaccari) was sanctioned in part for failing to communicate a change of its DPO's data to the Garante, evidencing a binding filing obligation regarding DPO contact information. Italy is an EU Member State applying GDPR directly, supervised by the Garante per la protezione dei dati personali, seated in Rome, operating under the Codice Privacy (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018) which adapts national law to GDPR. No general controller registration/notification regime survives GDPR; residual filing duties concern DPO contact-data communication to the Garante. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (10) - [Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en) — The Garante per la protezione dei dati personali is Italy's independent administrative authority, established by Law No. 675/1996 and subsequently regulated by the Codice Privacy, designated as GDPR Art.51 supervisory authority and based only in Rome. - [Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en) — GDPR (Regulation (EU) 2016/679) applies directly in Italy and is implemented/adapted via the Codice Privacy (D.Lgs. 196/2003) as amended by D.Lgs. 101/2018. - [Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10243180) — Garante decisions consistently apply GDPR material-scope concepts (Art.4(2) processing, including dissemination) requiring a lawful basis for any processing operation under Italian law. - [Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10269594) — The Garante exercised jurisdiction over Character Technologies Inc. (a US company operating Character.AI), citing among other violations a delayed designation of its EU representative, confirming extraterritorial application of GDPR to non-EU controllers targeting Italian users. - [Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10259523) — A public-sector controller (Comune di Mirabella Imbaccari) was sanctioned in part for failing to communicate a change of its DPO's data to the Garante, evidencing a binding filing obligation regarding DPO contact information. - [SimplyBiz](https://www.simplybiz.eu/decreto-legislativo-179-2026-ai-act-autorita-vigilanza/) — D.Lgs. 7 ottobre 2026, n. 179 — Designates AgID and ACN as Italy's national AI Act authorities and assigns supervision of high-risk AI systems used in banking/financial services to Banca d'Italia, in investment services to CONSOB, and in insurance to IVASS, each within its pre-existing sectoral competence. - [MilanoToday](https://www.milanotoday.it/cronaca/foto-cadavere-chiara-poggi-giornale.html) — Garante per la protezione dei dati personali — Sole national DPA, historically one of the EU's most active enforcers. - [MioLegale](https://miolegale.it/norme/codice-privacy-dlgs-196-2003/) — D.Lgs.196/2003 — Garante per la protezione dei dati personali designated as GDPR Art 51 supervisory authority - [Altalex](https://www.altalex.com/documents/codici-altalex/2014/02/10/codice-della-privacy) — D.Lgs.196/2003 — Codice Privacy coordinated text last amended 19 February 2026 (D.L. 19/2026 converted) following L.182/2025 and D.Lgs.215/2025 - [CASRAI](https://casrai.org/guides/italy-ai-law-132-2025) — Legge 132/2025 Art 20 — AgID = AI Act Art 70 notifying authority; ACN = market surveillance/EU contact point/inspection & sanctioning authority; Garante retains GDPR/Codice Privacy enforcement ### Italy: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category doctrine is settled and actively enforced; anonymisation-specific guidance coverage is thinner. Primary framework GDPR Arts. 6, 7, 9 + Codice Privacy Artt. 2-sexies, 2-septies, 2-quinquies Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green Core lawful-basis and special-category doctrine is settled and actively enforced; anonymisation-specific guidance coverage is thinner. Periodic update · new data 2026-10-11 #### Lawful Processing & Special Data The Garante's decision against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, found that the company processed the health data of approximately one million patients, drawn from around 800 general practitioners, without an adequate legal basis and without adequately informing patients. The decision carries a second, structurally more significant finding: the Garante rejected IQVIA's claim that the dataset was anonymous. It found that a persistent per-patient code, combined with detailed health, demographic and location attributes, made re-identification reasonably possible, so the data remained personal data subject to the full special-category regime rather than falling outside GDPR's scope as genuinely anonymous information. The decision reportedly sets, for the first time in the Garante's enforcement practice, a numeric equivalence-class threshold for assessing anonymity claims over health data — a test grounded in how many individuals could plausibly share the same combination of attributes within the dataset, rather than a simple assessment of whether direct identifiers were removed. This reasoning establishes a more demanding evidentiary standard for any controller in Italy seeking to rely on anonymisation as a basis for processing health data outside the special-category lawful-processing regime. A controller can no longer assume that removing a name or similar direct identifier is sufficient; it must be able to demonstrate, with some degree of rigour, that the remaining combination of attributes does not make re-identification reasonably possible. The decision's reasoning was reported via secondary press sources rather than the Garante's own published text, which has not yet been directly retrieved. #### Outlook The clearest next step is confirmation of the IQVIA decision's full text against the Garante's own publication, to establish the precise contours of the equivalence-class threshold the decision reportedly introduces. Controllers processing health data in Italy under an anonymisation rationale should treat this decision as a signal that the bar for such claims is rising, pending that confirmation. D2 · Lawful Processing — Full Module Record 4 sub-modules · 61 words · 4 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights framework is GDPR-aligned and actively enforced with concrete recent case law on response deadlines and opposition rights. Primary framework GDPR Arts. 12, 15-22 + Codice Privacy Artt. 2-decies, 130 Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green Rights framework is GDPR-aligned and actively enforced with concrete recent case law on response deadlines and opposition rights. #### Sub-modules (5) #### Access RightGreen Access and other Art.15-22 rights must receive an adequate, timely response under Art.12; failure led to a formal admonishment in a 2026 decision. Claims (1): - The Garante issued a formal admonishment under Art.58(2)(b) GDPR against a controller for failing to comply with Art.12 obligations to provide an adequate and timely response to rights exercised under Arts.15-22 GDPR. #### Rectification And ErasureGreen Erasure/rectification obligations (Art.16-17 GDPR) are enforced, e.g. in minor-image publication cases requiring takedown upon parental request. Claims (1): - The Garante has repeatedly ordered controllers/individuals to cease further processing of a minor's image absent both parents' consent, treating unlawful publication as requiring takedown under Art.17(1)(d) GDPR. #### Restriction And ObjectionGreen The right to object to direct-marketing processing is operationalised nationally via the Registro Pubblico delle Opposizioni (RPO); failure to timely register an opposition has been sanctioned. Claims (1): - A telemarketing company was sanctioned for failing to timely register a data subject's opposition made via formal notice, despite repeated follow-up, confirming the RPO/objection mechanism as an enforceable data-subject right. #### Data PortabilityGreen Portability (Art.20 GDPR) applies directly as EU law; no Italy-specific derogation identified in this cycle. #### Deadlines And Response WindowsGreen Controllers must provide adequate and timely responses to rights requests under Art.12; the Garante has rejected staff-absence (holiday period) as an excuse for delay. Claims (1): - The Garante held that a company's summer holiday period could not excuse a controller from its ongoing obligation to respond to data-subject rights requests without undue delay. Garante enforcement gives operative content to Arts.12 and 15-22 GDPR, requiring an adequate and timely response to rights requests, sanctioning controllers (including via formal admonishment) for delayed or absent responses, and treating opposition/telemarketing-suppression requests (Registro Pubblico delle Opposizioni) as an enforceable objection mechanism. Sources and claims (4) - [Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10241926) — The Garante issued a formal admonishment under Art.58(2)(b) GDPR against a controller for failing to comply with Art.12 obligations to provide an adequate and timely response to rights exercised under Arts.15-22 GDPR. - [Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10181642) — The Garante has repeatedly ordered controllers/individuals to cease further processing of a minor's image absent both parents' consent, treating unlawful publication as requiring takedown under Art.17(1)(d) GDPR. - [Garante Privacy](https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9921112) — A telemarketing company was sanctioned for failing to timely register a data subject's opposition made via formal notice, despite repeated follow-up, confirming the RPO/objection mechanism as an enforceable data-subject right. - [Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10241926) — The Garante held that a company's summer holiday period could not excuse a controller from its ongoing obligation to respond to data-subject rights requests without undue delay. ### Italy: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is GDPR-aligned and enforced robustly, but repeated large fines for DPIA/retention/security gaps (Poste Italiane, public-sector breaches) indicate ongoing compliance friction. Primary framework GDPR Arts. 24, 25, 30, 32-34, 35, 37-39 + Codice Privacy Artt. 2-quaterdecies, 166 Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Framework is GDPR-aligned and enforced robustly, but repeated large fines for DPIA/retention/security gaps (Poste Italiane, public-sector breaches) indicate ongoing compliance friction. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Businesses, platforms and newsletter operators in Italy must bring tracking-pixel-related privacy notices, consent mechanisms and withdrawal mechanisms into line with the Garante's Linee guida sui tracking pixel by 29 October 2026. This compliance deadline was reiterated in the Garante's newsletter of 8-9 October 2026; the underlying guidelines themselves entered into force before this cycle's reporting window, so what is new this cycle is the regulator's active reiteration of an approaching deadline rather than a change to the underlying substantive obligation. The guidelines' own legal-instrument citation has not been independently retrieved this cycle, so the precise statutory or regulatory basis for the guidelines cannot be stated with full precision at this time. The practical effect for controllers and processors operating tracking pixels on websites, platforms or in email newsletters is that consent capture, notice content, and withdrawal mechanisms tied to pixel-based tracking must be reviewed and, where necessary, remediated ahead of the deadline. The Garante's active reiteration of the deadline through its public newsletter channel suggests the regulator is treating this as a live compliance priority rather than a routine, low-visibility requirement. #### Outlook The 29 October 2026 deadline is imminent. Entities operating tracking pixels without current alignment to the Garante's guidelines face a narrow remaining window to achieve compliance. Watch for whether the Garante follows the deadline with enforcement activity against non-compliant operators, which would indicate the reiterated deadline functions as an active enforcement trigger rather than a guidance reminder without immediate consequence. Periodic update · new data 2026-10-11 #### Controller/Processor Duties The Garante's IQVIA decision, provvedimento n. 710 of 23 September 2026, made three distinct findings on accountability and controllership. First, the company had not defined data retention periods for data that, in some cases, dated back to 2001 — a failure to set and apply a retention policy consistent with the data-minimisation and storage-limitation principles. Second, IQVIA had not carried out a data protection impact assessment despite processing health data at scale. Third, the Garante found IQVIA had not adopted adequate security measures for the dataset in question. A 120-day compliance deadline, running from notification of the decision, was imposed to remedy these failures. On controllership itself, the Garante held that IQVIA was the data controller from the point at which it collected data at the offices of the roughly 800 general practitioners involved, rejecting any characterisation that would place controllership solely with the GPs themselves. This finding is significant for any data-aggregation or data-intermediation business model built around collecting data from a dispersed network of independent professional sources: the point of collection, not merely the point of onward use, can anchor controllership. The same proceeding reportedly absorbed a separate procedure concerning a personal-data breach that IQVIA had itself notified to the Garante, suggesting the breach notification and the substantive processing failures were considered together in reaching the Eur7 million sanction, though the precise weighting between the two strands was not detailed in the secondary reporting reviewed this cycle. #### Outlook The 120-day compliance deadline imposed on IQVIA is a concrete marker to watch: confirmation of IQVIA's remedial steps, including retention-period definition, a completed DPIA, and enhanced security measures, would indicate how the Garante expects compliance to be demonstrated following a controllership-and-accountability finding of this kind. Periodic update · new data 2026-09-28 #### Controller/Processor Duties The Garante's Provvedimento n. 237, dated 17 April 2026, sanctioned Poste Italiane and its PostePay division for unlawful monitoring of applications installed on users' Android devices. This matter falls squarely within the controller/processor duties framework because it turns on the adequacy of security-of-processing measures and the accountability obligations that attach to a controller operating consumer-facing mobile applications. Monitoring the applications installed on a user's device, beyond what is necessary for the stated purpose of the service being provided, raises questions of purpose limitation and data minimisation that sit at the heart of the controller's accountability obligations under the framework the Garante enforces. While the sanction itself is reported at a probable confidence level, drawing on a secondary summary rather than direct retrieval of the full text of Provvedimento n. 237, the underlying pattern is consistent with the Garante's established enforcement posture toward large consumer-facing financial and postal-services groups: security-of-processing failures involving device-level data collection have previously drawn Garante attention, and this action continues that pattern. The involvement of PostePay, a payment-services brand operating under the broader Poste Italiane group, places the matter within a sector where the Garante has historically maintained close scrutiny given the scale of the consumer base involved. For controllers operating consumer mobile applications in Italy, the practical implication is that monitoring practices extending to the broader set of applications installed on a user's device, rather than being confined to the data strictly necessary for the service's own functionality, present a live enforcement risk. The accountability principle requires that any such monitoring be justified by a documented, proportionate purpose and be transparent to the data subject; absent that justification, the Garante has shown itself willing to sanction on exactly this fact pattern. #### Outlook The Poste Italiane/PostePay sanction should be read as a signal that the Garante continues to treat device-level application monitoring as a live enforcement priority within its broader controller/processor duties remit. Operators of consumer-facing mobile applications in the Italian market, particularly within financial and postal services, should expect continuing scrutiny of similar monitoring practices. No further detail on the full scope or remedial requirements of Provvedimento n. 237 was available in the sources reviewed this cycle, and confirmation from a primary Garante publication would strengthen the evidentiary basis for this finding in a future cycle. Periodic update · new data 2026-09-21 #### Controller/Processor Duties The Garante's controller/processor duties enforcement this cycle centres on data-minimisation and retention accountability. On 24 February 2026, the Garante issued an order concerning Amazon worker-data record-keeping practices, addressing excess data retention in the employment context. Separately, on 29 April 2026, the Garante issued guidance against accommodation providers retaining copies of guest identity documents, a similar retention-minimisation intervention in the hospitality sector. Both are Probable-confidence findings, sourced from the Garante's own Tier-1 press-room index, though the full text of the underlying provvedimenti was not retrieved this cycle, which limits the granularity of what can be reported about the specific corrective measures ordered in each case. Taken together, these two orders confirm active accountability and data-minimisation enforcement by the Garante across at least two distinct sectors, employment and hospitality, within a single reporting window. This pattern is consistent with tightening in this module's trajectory, reflecting a regulator actively testing retention practices against the GDPR's data-minimisation and storage-limitation principles rather than confining enforcement attention to breach-notification or consent failures alone. #### Outlook Watch for the full text of both the Amazon worker-data order and the accommodation-provider guidance to become available, which would allow a more granular assessment of what data-retention thresholds the Garante is now applying, and for whether this retention-focused enforcement pattern extends to further sectors in the coming cycle. D4 · Controller & Processor — Full Module Record 7 sub-modules · 62 words · 10 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Transfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific localisation barrier identified for AI systems. Primary framework GDPR Arts. 44-49 (directly applicable EU Regulation) Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green Transfer mechanisms are fully harmonised at EU level and directly applicable; no Italy-specific localisation barrier identified for AI systems. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 66 words · 4 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Sectoral overlays are well documented and enforced, but employment/telecoms marketing overlays show recurrent, material non-compliance. Primary framework GDPR + Codice Privacy sectoral provisions (Artt.114, 122, 130) + Statuto dei Lavoratori (L.300/1970) + AI Act national implementing decree Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Sectoral overlays are well documented and enforced, but employment/telecoms marketing overlays show recurrent, material non-compliance. Periodic update · new data 2026-10-18 #### Sectoral Watch Under Article 29 of the EU Data Act, Regulation (EU) 2023/2854, charges for switching between cloud and data-processing services are capped at the provider's direct switching costs until 12 January 2027. From that date, such switching charges are prohibited outright. This is a directly applicable EU regulation, meaning it takes effect in Italy without requiring a separate national transposition statute, though Member States may still need to designate a national competent authority or data coordinator for enforcement purposes. Italy's national competent authority or data coordinator for the Data Act has not been confirmed as designated as of this cycle, and no Italy-specific implementing instrument has been identified. This provision is relevant to any cloud or data-processing service provider operating in or serving the Italian market, and to businesses relying on such services who may currently face switching costs that will become entirely prohibited from January 2027. The absence of a confirmed Italian national competent authority designation is itself a notable gap: enforcement mechanics for Italian customers of cloud-switching arrangements remain unclear pending that designation. #### Outlook The key date to track is 12 January 2027, when the switching-cost prohibition takes full effect across the EU including Italy. Separately, and arguably more immediately relevant for Italian market participants, is whether Italy designates a national competent authority or data coordinator for Data Act enforcement before that date; the absence of such a designation as of this cycle leaves an open question about which Italian authority, if any, will be responsible for enforcing the switching-cost prohibition domestically. Periodic update · new data 2026-10-11 #### Sectoral Watch The Garante issued two sectoral developments on 1 October 2026. First, it republished an updated edition of its practical guide, 'Privacy e recupero crediti', addressed to banks, finance companies, phone and energy companies engaged in debt-recovery activity. This is a routine guidance republication rather than a substantive rule change, but it signals continued regulatory attention to the debt-collection sector's data-protection practices across multiple industries. Second, and more substantively, the Garante expressed a favourable opinion, with observations, on the draft legislative decree transposing EU Directive 2024/2831 on platform work into Italian law. The Garante's observations specifically asked for greater attention to rider privacy in the transposition, a sector-specific concern given the extent of location, performance and activity-monitoring data typically generated by platform-based delivery and ride-hailing work. The opinion was favourable overall but conditioned on these observations being addressed as the decree proceeds, a posture consistent with the Garante's established practice of engaging with government transposition drafts ahead of their final adoption rather than only after the fact. #### Outlook The transposition decree for the EU Platform Work Directive is the clearer marker to watch here: whether the final adopted text incorporates the Garante's rider-privacy observations, and how the debt-recovery guidance republication is received across the banking, finance, telecommunications and energy sectors it addresses, are both worth tracking as this decree moves through the legislative process. Periodic update · new data 2026-09-28 #### Sectoral Watch The Garante's inspection plan for the second half of 2026 identifies at least 35 inspections to be conducted between August and December. The plan marks a deliberate shift in sectoral focus: AI-system checks, which had previously concentrated on the education sector and schools specifically, are being redirected toward municipalities, local health authorities (ASL), geomarketing, neuromarketing, dynamic pricing, and DPO-supplier relationships. This redirection signals that the Garante's sectoral enforcement priorities for the remainder of 2026 are moving away from education-sector AI deployments and toward public-administration bodies and commercial pricing/marketing-technology practices that involve algorithmic processing of consumer or citizen data. The inclusion of municipalities and local health authorities as inspection targets is notable because it extends the Garante's practical sectoral attention into public-sector bodies that increasingly deploy AI-assisted systems for service delivery and resource allocation, sectors that had not previously been named as a discrete inspection priority. Similarly, the explicit naming of geomarketing, neuromarketing and dynamic pricing as inspection targets reflects a sectoral focus on commercial practices that use behavioural or location data to shape consumer-facing pricing or marketing decisions, an area where AI-driven personalisation techniques raise the kind of profiling and transparency questions the Garante has flagged in other contexts this cycle. This sectoral shift should be read alongside the broader enforcement-and-redress picture for the cycle, in which two concrete sanctions (Poste Italiane/PostePay and Altroconsumo Edizioni) were already recorded; the expanded inspection programme suggests the Garante intends to sustain, rather than taper, its practical enforcement tempo through the remainder of 2026, with AI systems and public-sector/commercial-marketing practices as the named sectoral targets. #### Outlook Operators in the named sectors, particularly municipalities, local health authorities, and providers of geomarketing, neuromarketing, or dynamic-pricing technology serving Italian consumers, should treat the August-December 2026 window as a period of elevated inspection risk. The DPO-supplier relationship focus also suggests that outsourced data-protection-officer arrangements will receive specific scrutiny during this period. No further detail on the specific inspection criteria or expected enforcement outcomes was available in the sources reviewed this cycle. Periodic update · new data 2026-09-21 #### Sectoral Watch Italy's telecoms and e-privacy sectoral overlay was confirmed applicable to a new use case this cycle: Codice Privacy Article 130(1) requires opt-in consent for automated calling systems, and this requirement is confirmed to extend to AI voice agents specifically. An opt-out mechanism such as the Registro delle Opposizioni (RPO) list is explicitly insufficient to satisfy this opt-in requirement, an Assessed-confidence finding sourced from the Garante's own Tier-1 guidance on artificial intelligence. This finding is significant because it closes a potential ambiguity as automated calling technology increasingly incorporates generative AI voice capabilities: the existing sectoral telecoms consent standard, rather than being displaced or superseded by AI-specific rules, is confirmed to continue applying in full to AI-driven calling systems. Businesses deploying AI voice agents for outbound calling in Italy therefore cannot rely on opt-out registration alone and must secure affirmative opt-in consent under the existing Article 130(1) standard. #### Outlook Watch for whether the Garante issues further sector-specific guidance applying existing telecoms and e-privacy standards to other AI-driven communication channels, and for any enforcement action testing compliance with the opt-in standard specifically in the context of AI voice agents. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 79 words · 11 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Rules are clear and mature but enforcement volume against cookie-banner manipulation and unconsented marketing remains high. Primary framework ePrivacy Directive 2002/58/EC as transposed by Art.122 Codice Privacy + GDPR Arts.4(11),6,7,12,13,25 Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Rules are clear and mature but enforcement volume against cookie-banner manipulation and unconsented marketing remains high. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy The Garante's guidelines on email tracking pixels, issued as Provvedimento n. 284 of 2026, reach the end of their six-month compliance window on 29 October 2026. The guidelines require prior, free, specific and informed opt-in consent before deploying any email tracking pixel capable of identifying the recipient upon opening the message. A narrow exception is carved out for pixels used strictly for deliverability, security, or institutional-communication purposes, where such tracking does not serve a marketing or profiling function. Organisations conducting commercial email campaigns into Italy that rely on open-tracking pixels without having obtained the required opt-in consent face exposure once the compliance window closes. The guidance reflects the Garante's broader approach to consent-based lawful bases for tracking technologies in the commercial-privacy space, treating pixel-based open-tracking as functionally equivalent to other tracking technologies requiring prior consent rather than treating it as incidental to message delivery. The narrowness of the stated exception suggests limited scope for commercial actors to rely on operational necessity as a basis for continuing undisclosed open-tracking after the deadline passes. #### Outlook With the compliance deadline falling on 29 October 2026, the immediate question is how actively the Garante moves to enforcement against non-compliant senders once the window closes, and how strictly it interprets the deliverability/security/institutional exception in practice. No enforcement action under this specific guideline has been identified as yet. Periodic update · new data 2026-10-18 #### AdTech & Commercial Privacy The live adtech item for Italy this cycle is the approaching 29 October 2026 compliance deadline under the Garante's Linee guida sui tracking pixel. Businesses, platforms, and newsletter operators using tracking pixels for advertising, analytics, or engagement-measurement purposes must bring their privacy notices, consent-capture mechanisms, and withdrawal mechanisms into conformity with the guidelines by that date. The deadline was reiterated in the Garante's newsletter of 8-9 October 2026, indicating active regulatory attention to this compliance area ahead of the cut-off. Tracking pixels are commonly embedded in advertising creative, email newsletters, and analytics tooling, meaning the guidelines' practical reach extends across commercial adtech practice broadly rather than being confined to a narrow category of operator. The precise legal-instrument citation underlying the guidelines has not been independently retrieved this cycle, which limits the ability to state with full confidence the exact statutory hook (whether grounded directly in the Codice Privacy, in ePrivacy-derived cookie-consent rules, or in a standalone Garante guideline exercising its general regulatory powers) behind the pixel-specific requirements. #### Outlook With the compliance deadline now within weeks, the near-term question is the rate of market conformity achieved by 29 October 2026 and whether the Garante follows with visible enforcement against non-compliant tracking-pixel practices. A secondary item to confirm in a future cycle is the precise legal basis of the guidelines themselves, which would clarify the applicable penalty regime for non-compliance. Periodic update · new data 2026-10-11 #### AdTech & Commercial Privacy The Garante's guidelines on the use of tracking pixels in email marketing communications, adopted 17 April 2026, entered into force, per a notice dated 5 October 2026. These guidelines set standards for the use of tracking pixels, a technology commonly embedded in marketing emails to register when and whether a recipient has opened the message, bringing this practice within the Garante's active guidance framework for commercial email marketing. The precise relationship between the 17 April 2026 adoption date and the actual entry-into-force date was not confirmed against the Garante's own provvedimento text this cycle, and that gap should be noted before relying on either date as definitive. Separately, the Garante sanctioned a banking institution, under provvedimento 613/2026, for violations of the right to object to the use of personal data for commercial purposes, per reporting dated 14 September 2026. This finding rests on secondary reporting, as the provvedimento text itself was not directly retrieved this cycle; the specific nature of the commercial use to which the bank's customers objected was not detailed in the available sourcing. Taken together, these two developments show continued Garante activity on both ends of the commercial-privacy spectrum: proactive guidance-setting on tracking technology, and reactive enforcement against a financial-sector controller's handling of marketing-objection rights. #### Outlook Confirmation of the tracking-pixel guidelines' precise in-force date against the Garante's own text, and retrieval of the full provvedimento 613/2026 text concerning the banking institution's direct-marketing sanction, are the two clearest next steps to firm up this cycle's findings. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy The Garante's 29 July 2026 newsletter recorded a marketing-related enforcement matter against Altroconsumo Edizioni, resulting in a fine of EUR 280,000. This is the principal adtech and commercial-privacy development for Italy this cycle, though it should be treated with appropriate caution: the finding rests on a single source, the Garante's own newsletter announcement, and the underlying provvedimento's full reasoning and factual basis were not independently corroborated in the sources reviewed this cycle. Reports suggest the matter concerned marketing-related processing, though the precise nature of the violation, whether direct-marketing consent failures, unlawful profiling for marketing purposes, or another commercial-privacy issue, was not specified in the sources available. The scale of the fine, at EUR 280,000, indicates the Garante treated the underlying violation as a serious matter within its marketing-enforcement practice, consistent with the broader pattern this cycle of the Garante maintaining an active enforcement tempo across multiple sectors simultaneously. However, given the single-source basis for this specific finding, readers should treat the characterisation of the violation itself as provisional pending corroboration from the Garante's own primary publication of the full provvedimento text. #### Outlook Corroboration of the Altroconsumo Edizioni matter through a primary Garante publication would materially strengthen confidence in this finding for a future cycle. In the interim, the EUR 280,000 fine should be read as one data point within the Garante's broader active-enforcement posture this cycle, alongside the Poste Italiane/PostePay sanction, rather than as a fully resolved standalone finding. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 63 words · 14 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Governance architecture is advanced and the Garante has secured a central supervisory role, but the AI Act implementing framework remains partly in legislative process and biometric safeguards are still being strengthened per the Garante's own July 2026 comments. Primary framework GDPR Art.22 + EU AI Act (Regulation (EU) 2024/1689) + Italian AI Law (L.132/2025) + national AI Act implementing decree Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Governance architecture is advanced and the Garante has secured a central supervisory role, but the AI Act implementing framework remains partly in legislative process and biometric safeguards are still being strengthened per the Garante's own July 2026 comments. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Legislative Decree no. 179 of 7 October 2026, in force since 23 October 2026, directly answers the long-open question of which Italian authorities bear AI Act supervisory responsibility. AgID and ACN are designated as the national AI Act market-surveillance and notifying authorities, while Banca d'Italia, CONSOB and IVASS retain AI Act supervisory competence over high-risk AI systems within their respective pre-existing financial-sector remits -- banking and financial services, investment services, and insurance respectively. This settles, at the level of institutional design, how high-risk AI deployments in Italy's financial sector will be supervised going forward, removing ambiguity that had persisted since the AI Act's entry into application. The decree's approach of layering AI Act competence onto existing sectoral regulators, rather than creating a wholly new supervisory body for financial-sector AI, mirrors the general pattern of AI Act implementation in several EU Member States with established sectoral financial regulators. Full confirmation of the decree's scope and any transitional provisions awaits independent retrieval of its text; the account here is based on two consistent secondary press reports describing its substantive content. #### Outlook The practical operation of this supervisory split -- particularly how Banca d'Italia, CONSOB and IVASS coordinate with AgID and ACN on cross-cutting AI governance questions, and how the Garante's distinct data-protection competence interacts with all of the above -- will become clearer as the designated authorities begin exercising their new mandates. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance This is the most significant module for Italy this cycle, carrying four distinct developments that together indicate an escalating pattern of Garante engagement with algorithmic and AI-adjacent governance ahead of, and independent of, the formal enactment of Italy's AI Act implementing legislation. The most material of these developments is the Garante's favourable opinion on Italy's draft legislative decree implementing the EU AI Act. The draft decree, as reviewed by the Garante, would designate the Garante itself as the market-surveillance authority for high-risk AI systems deployed in four sensitive contexts: justice administration, law enforcement, immigration and border management, and processes touching the democratic process. This is a substantial expansion of the Garante's institutional remit beyond its existing GDPR-based mandate, and it reflects a deliberate legislative choice to route AI Act market-surveillance responsibility for these particularly sensitive domains through the existing data-protection authority rather than creating a wholly new oversight body. As of this cycle, the decree remains at the proposed stage; the Garante's opinion is favourable but the decree has not yet been enacted, and its final text and effective date remain open questions. Separately, and demonstrating that the Garante is already applying AI Act principles operationally ahead of the implementing decree's enactment, the regulator issued a provvedimento dated 14 May 2026 addressing the use of AI systems in the workplace to analyse workers' emotional or psychological states. This provvedimento explicitly invoked the AI Act's prohibition on emotion-inference systems in the employment context, treating that prohibition as already operative guidance for employers deploying such systems on Italian workers, notwithstanding that the national implementing decree itself remains unenacted. A third development concerns biometric identification in the criminal-procedure context. The Garante has called for an express prohibition, to be incorporated within a pending reform introducing a new Article 359-ter biometric-identification framework into Italy's criminal-procedure law, on the use of databases obtained through indiscriminate scraping or otherwise assembled in violation of data-protection law. This is advocacy directed at a pending legislative reform rather than a completed instrument, but it signals the Garante's substantive position on how facial-recognition and biometric-identification databases used by law-enforcement bodies should be constrained. A fourth strand concerns generative AI directly. In a provvedimento dated 3 July 2026, the Garante examined the character.ai generative-AI companion service, noting specifically the existence of a dedicated version of the service for minor users, launched in November 2024. This examination sits at the intersection of algorithmic governance and the treatment of vulnerable users, and is addressed further under the children and vulnerable groups module. #### Outlook The enactment trajectory of the AI Act implementing decree is the central item to watch: a favourable Garante opinion is a meaningful procedural step but does not itself extend the Garante's market-surveillance remit until the decree is formally enacted. In the interim, the workplace-AI provvedimento and the biometric-scraping advocacy both demonstrate that the Garante is willing to apply AI Act-derived principles through its existing enforcement and policy powers, a pattern likely to continue as the decree moves through the remainder of the legislative process. Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance This module carries the highest density of material developments in Italy's data-protection landscape this cycle, with four distinct threads escalating simultaneously. First, the Garante imposed a EUR 158,000 fine on Character Technologies Inc. on 9 July 2026 for GDPR violations concerning privacy notices and child-protection and age-verification failures, a Confirmed-confidence, Tier-1-sourced primary enforcement action. Second, the Garante's ruling under Provvedimento 10281021 holds that AI Act transparency obligations for manipulated content become applicable from 2 August 2026, while clarifying that deepfakes are not per se a prohibited practice under the AI Act; at the time of the ruling this obligation was enacted but not yet effective, and it is now understood to be in force given the 2 August 2026 applicability date has since passed. This is a Confirmed-confidence, Tier-1-sourced finding. Third, the Garante flagged AI Act incompatibilities in a proposed police facial-recognition decree, specifically objecting to a 7-day biometric-data retention period that would apply regardless of whether a crime actually occurred, and called for modifications ahead of a final Council of Ministers vote expected before October 2026. This is a Probable-confidence finding, sourced at Tier 3, and represents an active, unresolved dispute between the regulator and the government over a still-proposed instrument. Fourth, and most structurally significant, the Court of Rome annulled the Garante's own December 2024 EUR 15 million fine and media-campaign order against OpenAI on 18 March 2026, on one-stop-shop jurisdiction grounds. This is a Confirmed-confidence finding, though sourced at Tier 3, and it represents a significant judicial reversal of the regulator's own enforcement action. Read together, this annulment and the continuing aggressive enforcement against Character.AI signal a meaningful judicial check on Italy's AI-enforcement reach even as the regulator continues pursuing smaller generative-AI operators, an Assessed-confidence key judgment. #### Outlook Watch for the final Council of Ministers vote on the facial-recognition decree, expected before October 2026, and for whether the Garante appeals the Court of Rome's OpenAI annulment or adjusts its jurisdictional approach to future one-stop-shop cases in light of that ruling. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 71 words · 12 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-of-consent framework is clear and enforced, but recurrent age-verification failures (Character.AI, TikTok precedent) show implementation gaps at platform level. Primary framework GDPR Art.8 + Codice Privacy Art.2-quinquies Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Amber Age-of-consent framework is clear and enforced, but recurrent age-verification failures (Character.AI, TikTok precedent) show implementation gaps at platform level. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups The Garante's provvedimento dated 3 July 2026 examined the generative-AI companion service character.ai, with particular attention to a dedicated version of the service designed for minor users, which had been launched in November 2024. This examination places Italy's data-protection regulator among those actively scrutinising generative-AI companion services for their treatment of under-18 users, a category of service that raises distinct concerns given the emotionally engaging, conversational nature of the product and the potential for minors to form parasocial attachments to an AI companion without adult-level capacity to assess the risks of doing so. The existence of a dedicated minors-facing version of the service, launched nearly two years before the Garante's examination, indicates the provider had already made a deliberate product decision to serve the under-18 demographic, which in turn sharpens the regulatory question of what safeguards, age-verification mechanisms, and data-processing limitations were in place for that minors-specific product tier. The sources reviewed this cycle establish that the Garante examined the service and its minors-specific version, but do not specify the provvedimento's ultimate findings, remedial requirements, or sanctions, if any, arising from that examination. This generative-AI/minors matter should be read alongside the broader algorithmic-governance developments this cycle, particularly the workplace-AI emotion-inference provvedimento, as both reflect the Garante applying heightened scrutiny to AI systems that engage with, infer from, or affect the psychological and emotional states of individuals, whether workers or, in this case, minor users of a generative-AI product. #### Outlook Further detail on the character.ai provvedimento's findings and any resulting remedial measures would clarify whether Italy is moving toward a more prescriptive standard for minors-facing generative-AI products specifically. Given the Garante's demonstrated pattern of proactive AI-system scrutiny this cycle, further provvedimenti addressing other generative-AI companion or chatbot services with minor-facing product tiers should be considered a plausible continuation of this line of regulatory attention. Periodic update · new data 2026-09-21 #### Children & Vulnerable Groups The Garante's Character Technologies enforcement action carries a binding children's-data-protection dimension this cycle. Alongside the EUR 158,000 fine imposed 9 July 2026, the corrective-measures order requires Character Technologies to guarantee age-verification systems, implement cooling-off mechanisms preventing minor re-registration after account closure, and set default-private minor profiles, with compliance to be reported to the Garante within 120 days. This is a Confirmed-confidence, Tier-1-sourced finding with a binding compliance deadline, marking a tightening trajectory for this module. The specificity of the corrective measures, particularly the cooling-off mechanism preventing re-registration and the default-private setting for minor profiles, indicates the Garante is moving beyond generic GDPR privacy-notice failures toward prescriptive, child-specific design requirements for generative-AI platforms likely to be used by minors. The 120-day reporting deadline gives a concrete compliance-verification point in the near term. #### Outlook Watch for Character Technologies' 120-day compliance report to the Garante, due in approximately early November 2026 based on the 9 July 2026 order date, which will indicate whether the prescribed age-verification and cooling-off measures were implemented as ordered. D9 · Children's Privacy — Full Module Record 5 sub-modules · 57 words · 10 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Italy: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ High-volume, well-documented, and materially consequential enforcement activity with a functioning judicial-review channel; funding/headcount transparency is comparatively thin in public sources. Primary framework GDPR Arts. 58, 77-84, 83 + Codice Privacy Artt. 152, 154-bis, 166 + Reg. Garante 1/2019 and 2/2019 Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/) Traffic-light rationale — Green High-volume, well-documented, and materially consequential enforcement activity with a functioning judicial-review channel; funding/headcount transparency is comparatively thin in public sources. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Garante imposed a EUR 7 million fine on IQVIA Solutions Italy Srl by Provvedimento n. 710 of 6 October 2026, rejecting the company's position that health data concerning approximately one million patients had been rendered anonymous. The Garante found that a persistent per-patient code retained within the processing system enabled re-identification of individuals, meaning the data had in substance remained personal data rather than achieving genuine anonymisation. On this basis, the Garante held that IQVIA's processing violated GDPR Articles 5 (principles relating to processing), 9 (special categories of data, given the health-data context), 13 (information to be provided), 25 (data protection by design and by default), 28 (processor obligations), 32 (security of processing) and 35 (data protection impact assessment). The decision is a significant marker of the Garante's enforcement posture toward the anonymisation standard, rejecting a claim of anonymisation where a technical identifier persisted that could in practice be used to re-link data to individuals. This has particular salience for health-data controllers and processors relying on pseudonymisation techniques -- such as persistent per-subject codes -- while characterising their output as anonymous for regulatory purposes. The full text of Provvedimento n. 710/2026 has not been independently retrieved; this account relies on secondary reporting of the decision's substance and legal basis. #### Outlook The IQVIA decision is likely to be read by other health-data controllers in Italy as a signal to review whether pseudonymisation techniques they characterise as anonymisation would withstand the same scrutiny. Whether IQVIA appeals the decision, and the outcome of any such appeal, would be the next material development to watch in this matter. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Garante per la protezione dei dati personali fined Cairo Editore 9,380 euros by provvedimento n.759 of 23 September 2026, published 16 October 2026, for publishing images of a crime scene found not essential to the informational purpose of the article in question. The fine was issued under the essentiality-of-information principle and dignity-protection rules applicable to journalistic activity, and concerns the same underlying case — the Garlasco case — that produced an earlier fine against RTI on 29 July 2026. The Garante is applying the same legal theory repeatedly across multiple publishers within a relatively short reporting period, which indicates a sustained enforcement line specific to this case rather than an isolated application of the essentiality-of-information principle. This pattern is significant for media organisations covering high-profile criminal cases generally: the Garante's recurring willingness to find that crime-scene or victim-related imagery exceeds what is essential to inform the public, even where the underlying facts being reported are themselves newsworthy, signals an active and specific enforcement posture on image selection in crime journalism rather than a generalised tightening of journalistic-exception rules as a whole. #### Outlook Given the recurring nature of this enforcement line — two fines against two different publishers over the same case within a roughly two-and-a-half-month span — further enforcement action against additional publishers that covered the same case with similar imagery is plausible. Watch for whether the Garante's approach in this case influences its treatment of image-publication decisions in other high-profile criminal matters going forward, which would indicate a durable shift in enforcement emphasis rather than a case-specific response. Periodic update · new data 2026-10-11 #### Enforcement & Redress Italy's enforcement activity was notably active this cycle, anchored by the Garante's Eur7 million fine against IQVIA Solutions Italy S.r.l., provvedimento n. 710 of 23 September 2026, for the unlawful processing of health data belonging to approximately one million patients of around 800 general practitioners. This is among the larger fines the Garante has issued and reflects the seriousness with which the authority treated both the lawful-basis failure and the rejected anonymisation claim underlying the processing. On the same date, 23 September 2026, the Garante issued a second, much smaller enforcement decision, provvedimento n. 634, fining Fondazione Rome Technopole Eur8,000 for publishing online the personal data of 480 scholarship-award winners. Though modest in scale by comparison to the IQVIA fine, this decision is a reminder that the Garante's enforcement activity spans a wide range of controller types and data volumes, from large-scale health-data processing by a multinational data company to a more limited publication of award-recipient data by a research foundation. A third enforcement thread, the banking institution sanctioned under provvedimento 613/2026 for direct-marketing objection-right violations reported 14 September 2026, adds to the picture of a Garante actively pursuing enforcement across sectors in this window. The full texts of provvedimento n.710/2026 and n.634/2026 were not directly retrieved from the Garante's own publication channel this cycle; the findings rest on secondary press reporting and, for n.634, a direct Garante docweb reference. #### Outlook Direct retrieval of the full provvedimento texts for n.710/2026 (IQVIA) and n.634/2026 (Fondazione Rome Technopole) from garanteprivacy.it would firm up the precise legal reasoning and sanction calculation behind both decisions. The IQVIA decision's 120-day compliance deadline is the clearest concrete marker to track going forward. Periodic update · new data 2026-09-28 #### Enforcement & Redress Italy's enforcement and redress picture this cycle is defined by two concrete sanctions and one significant forward-looking programme. The Garante sanctioned Poste Italiane and its PostePay division in Provvedimento n. 237 of 17 April 2026, for unlawful monitoring of applications installed on users' Android devices, a matter addressed in detail under the controller/processor duties module. Separately, the Garante's 29 July 2026 newsletter recorded a EUR 280,000 fine against Altroconsumo Edizioni for a marketing-related violation, a finding that rests on a single source this cycle and should be treated as provisional pending corroboration. Beyond these two concluded matters, the Garante's inspection plan for the second half of 2026 represents a significant expansion of its forward enforcement pipeline: at least 35 inspections are planned for the August-to-December window, with sectoral scope expanding to include geomarketing, neuromarketing, dynamic pricing, DPO-supplier relationships, municipalities, local health authorities, and AI systems generally. This expanded inspection programme, considered alongside the two concrete sanctions already recorded this cycle, indicates the Garante is sustaining an active enforcement tempo across a widening set of sectors rather than concentrating attention on a narrow set of repeat targets. The combination of concrete sanctions with an expanding forward inspection programme is itself the significant structural fact for this module this cycle: it indicates the Garante's enforcement posture is both active in the present and set to broaden further in scope over the remainder of 2026. #### Outlook The 35-plus inspections planned for August-December 2026 should be watched closely, both for their outcomes and for whether the sectoral pattern (municipalities, ASL, geomarketing, neuromarketing, dynamic pricing, DPO-supplier relationships, AI systems) proves predictive of where the Garante's next concrete sanctions land. Corroboration of the Altroconsumo Edizioni fine through a primary Garante publication remains an open item for a future cycle. Periodic update · new data 2026-09-21 #### Enforcement & Redress Italy's enforcement and redress landscape this cycle is marked by both continued aggressive fining activity and a significant judicial check on the regulator's own reach. The Character Technologies fine of EUR 158,000, imposed 9 July 2026, is a Confirmed-confidence, Tier-1-sourced primary enforcement action. Separately, reporting indicates Intesa Sanpaolo was fined EUR 31.8 million in March 2026 for an insider data breach; however, this figure is sourced only from a Tier-4 secondary compilation and could not be corroborated against a Garante primary provvedimento this cycle, and is accordingly reported at Uncertain confidence with attribution limited to the secondary source rather than presented as an established fact. The most structurally significant development is the Court of Rome's annulment, on 18 March 2026, of the Garante's own December 2024 EUR 15 million fine and media-campaign order against OpenAI, on one-stop-shop jurisdiction grounds. This is a Confirmed-confidence finding, sourced at Tier 3, and represents a meaningful check on the scope of the Garante's enforcement jurisdiction in cross-border AI cases. Separately, the Garante is confirmed, at Probable confidence from a Tier-4 source, to act as competent authority for AI Act enforcement in areas overlapping data protection, particularly for high-risk AI systems processing personal data, expanding its effective enforcement remit even as the OpenAI annulment narrows its jurisdictional reach in one specific respect. #### Outlook Watch for primary-source corroboration of the reported Intesa Sanpaolo fine, which remains an open evidentiary gap, and for whether the Garante's expanded AI Act competent-authority role generates new enforcement activity distinguishable from its existing GDPR enforcement programme. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 116 words · 24 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action