---
title: "Italy — Regulator & Framework | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/italy/regulator-and-framework/
source_html: /jurisdictions/italy/regulator-and-framework/index.html
description: "Italy — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 5 claims Green ▾ # Mature, fully-operational omnibus regime with an active, well-resourced supervisory authority and den"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 34742ac12da66219dd5a22fb1d8a1b141774dd60546954f33f55339acea81182
generator: "fe-fleet/md-twin@1.0"
---
# Italy — Regulator & Framework | Data Protection Monitor

### D1Regulator & Framework5 sub-modules5 claimsGreen▾#

Mature, fully-operational omnibus regime with an active, well-resourced supervisory authority and dense enforcement caseload.

Primary framework GDPR (Regulation (EU) 2016/679) + Codice in materia di protezione dei dati personali (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018)

Supervisory authority [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/)

Traffic-light rationale — Green Mature, fully-operational omnibus regime with an active, well-resourced supervisory authority and dense enforcement caseload.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

The Garante is Italy's independent DPA, based only in Rome, designated GDPR Art.51 supervisory authority.

Claims (1):

- The Garante per la protezione dei dati personali is Italy's independent administrative authority, established by Law No. 675/1996 and subsequently regulated by the Codice Privacy, designated as GDPR Art.51 supervisory authority and based only in Rome.

#### Act And InstrumentsGreen

GDPR applies directly; Codice Privacy (D.Lgs.196/2003) as amended by D.Lgs.101/2018 is the national implementing/adapting act.

Claims (1):

- GDPR (Regulation (EU) 2016/679) applies directly in Italy and is implemented/adapted via the Codice Privacy (D.Lgs. 196/2003) as amended by D.Lgs. 101/2018.

#### Material ScopeGreen

Material scope follows GDPR directly as an EU Regulation; Codice provisions (e.g. 2-septies, 2-decies) supplement special-category and remedies rules.

Claims (1):

- Garante decisions consistently apply GDPR material-scope concepts (Art.4(2) processing, including dissemination) requiring a lawful basis for any processing operation under Italian law.

#### Territorial ScopeGreen

GDPR Art.3 territorial scope applies uniformly in Italy as directly-applicable EU law; non-EU providers (e.g. Character Technologies/US) have been pursued by the Garante including EU-representative designation failures.

Claims (1):

- The Garante exercised jurisdiction over Character Technologies Inc. (a US company operating Character.AI), citing among other violations a delayed designation of its EU representative, confirming extraterritorial application of GDPR to non-EU controllers targeting Italian users.

#### Regulator Registration And FilingAmber

No general controller registration regime; residual duty to notify the Garante of DPO data changes, breach of which has been separately sanctioned.

Claims (1):

- A public-sector controller (Comune di Mirabella Imbaccari) was sanctioned in part for failing to communicate a change of its DPO's data to the Garante, evidencing a binding filing obligation regarding DPO contact information.

Category narrative 57 words

Italy is an EU Member State applying GDPR directly, supervised by the Garante per la protezione dei dati personali, seated in Rome, operating under the Codice Privacy (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018) which adapts national law to GDPR. No general controller registration/notification regime survives GDPR; residual filing duties concern DPO contact-data communication to the Garante.

Evidence 5

Sources and claims (5)
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en) — The Garante per la protezione dei dati personali is Italy's independent administrative authority, established by Law No. 675/1996 and subsequently regulated by the Codice Privacy, designated as GDPR Art.51 supervisory authority and based only in Rome.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/web/garante-privacy-en) — GDPR (Regulation (EU) 2016/679) applies directly in Italy and is implemented/adapted via the Codice Privacy (D.Lgs. 196/2003) as amended by D.Lgs. 101/2018.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10243180) — Garante decisions consistently apply GDPR material-scope concepts (Art.4(2) processing, including dissemination) requiring a lawful basis for any processing operation under Italian law.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10269594) — The Garante exercised jurisdiction over Character Technologies Inc. (a US company operating Character.AI), citing among other violations a delayed designation of its EU representative, confirming extraterritorial application of GDPR to non-EU controllers targeting Italian users.observed 2026-08-03
- Confirmed[Garante Privacy](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10259523) — A public-sector controller (Comune di Mirabella Imbaccari) was sanctioned in part for failing to communicate a change of its DPO's data to the Garante, evidencing a binding filing obligation regarding DPO contact information.observed 2026-08-03