Italy · Compliance
GDPR compliance in Italy
Achieve GDPR compliance in Italy with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Frankfurt office team
- Effivity software included
- Academy training included
Who asks for GDPR in Italy
Clients include
GDPR compliance in Italy at a glance
Regulation (EU) 2016/679 (GDPR) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Italy ask for evidence that you meet it.
The Garante per la protezione dei dati personali is the authority that matters in Italian GDPR work. The Codice in materia di protezione dei dati personali, Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, names it as the supervisory authority and adds national rules, among them the treatment of a minor's consent to online services and of special categories of data processed for substantial public interest. There is no mandatory GDPR certificate, although a voluntary scheme, ISDP 10003, is accredited by Accredia and issued by product-certification bodies. Compliance is shown through records of processing, notices, processor contracts, rights handling, breach procedures and security measures. Sterling's Frankfurt office builds that evidence for Italian entities, aligns it with ISO/IEC 27701 where an external benchmark is wanted, and includes Effivity and Sterling Academy in the engagement. Italian questions follow.
Who needs GDPR in Italy, and what happens without it
These are the organisations in Italy that most often need to show GDPR.
- Companies processing personal data in ItalySupervised by the Garante per la protezione dei dati personali under the GDPR and the Codice.
- Online services aimed at childrenArt. 2-quinquies of the Codice sets the rule on a minor's consent and requires clear, simple information for minors.
- Organisations processing special categories of dataArt. 2-sexies of the Codice addresses special categories processed for substantial public interest.
- Organisations wanting an external benchmarkThe voluntary ISDP 10003 scheme is accredited by Accredia and issued by accredited product-certification bodies.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the GDPR readiness checkGDPR requirements in Italy
Strip away the vocabulary and the GDPR requires an organisation to comply in six areas covering how it uses personal data.
In Italy these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: GDPR explained →
How to achieve GDPR compliance in Italy
One team from the Frankfurt office carries the work from scoping to sign-off. Clients across Italy are served from Sterling's Frankfurt office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against GDPR and the Italian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does GDPR compliance take in Italy?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Italy these are the factors that set the timeline.
- Number of processing activities and systems to map
- Number of legal entities and processors
- International-transfer and processor contract review
- Employee-data and monitoring questions in the workplace
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does GDPR compliance cost in Italy?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Italy these factors move both.
- Number of entities in scope
- Volume of processing activities and data subjects
- Security remediation needed
- External data protection officer arrangement
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
GDPR consultants and assessors in Italy
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers GDPR and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Italy are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive GDPR in Italy (4)
| Instrument | How it treats the standard |
|---|---|
| Regulation (EU) 2016/679 (GDPR) | The instrument itself In Italy the Garante is the supervisory authority under Article 51 of the Regulation. |
| Codice in materia di protezione dei dati personali (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018) | The instrument itself National adaptation to the GDPR, identifying the Garante as supervisory authority (art. 2-bis) and adding rules such as art. 2-quinquies and art. 2-sexies. |
| ISDP 10003 — voluntary GDPR conformity scheme | Related Accredited by Accredia, issued by product-certification bodies accredited under ISO/IEC 17065; optional. |
| Garante and Accredia — certification and accreditation under the GDPR | Related Certification bodies are accredited by the supervisory authority, the national accreditation body or both, with the supervisory authority's additional requirements applying to ISO/IEC 17065 accreditation. |
Accreditation, audit language and remote audits in Italy
Compliance, not certification: there is no mandatory GDPR certificate. Evidence is the controller's or processor's records of processing, notices, contracts, procedures and security measures. A voluntary GDPR certification such as ISDP 10003 is issued by product-certification bodies accredited by Accredia under ISO/IEC 17065, and ISO/IEC 27701 management-system certification is an optional benchmark. Edition and transition details: GDPR hub →
Audit language
The Garante's guidance and filings are in Italian; privacy notices must suit the audience they serve. Internal records can be kept in Italian or English.
Remote and on-site
Data-mapping workshops can be on-site or remote; no external assessment is prescribed for general compliance.
GDPR in Italy: questions clients ask
Which authority supervises GDPR compliance in Italy?
The Garante per la protezione dei dati personali. Italy's Codice in materia di protezione dei dati personali identifies the Garante in art. 2-bis as the supervisory authority referred to in Article 51 of the Regulation, and the Garante describes itself as an independent administrative authority. For a particular processing activity, ask your counsel or the Garante how its powers apply.
Is there a GDPR certificate in Italy?
Not a mandatory one, but a voluntary scheme exists. ISDP 10003 is accredited by Accredia to determine conformity with the GDPR and is issued by product-certification bodies accredited under ISO/IEC 17065. The Garante adds that the supervisory authority's additional requirements apply to that accreditation. Treat any certificate as optional evidence, not as a substitute for compliance.
What does the Italian Codice add to the GDPR for children online?
Art. 2-quinquies of the Codice implements the Regulation's rule on a child's consent to information society services. It sets the age from which a minor can consent alone, makes parental responsibility the basis for younger children, and requires the controller to give information in particularly clear, simple and accessible language. Check the exact wording with counsel before designing a sign-up flow.
Which law is Italy's national supplement to the GDPR?
Legislative Decree 196/2003, the Codice in materia di protezione dei dati personali, as amended by Legislative Decree 101/2018. Its first article provides that processing follows the Regulation and the Code, and it contains national rules such as those on special categories of data processed for substantial public interest. Your counsel can confirm which provisions bear on your sector.
More on GDPR for Italian organisations
Other standards Italian businesses ask Sterling for
Organisations in Italy often combine GDPR with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Frankfurt office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Regulation (EU) 2016/679 (GDPR) — garanteprivacy.it (accessed 7 Oct 2026)
- Codice in materia di protezione dei dati personali (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018) — garanteprivacy.it (accessed 7 Oct 2026)
- ISDP 10003 — voluntary GDPR conformity scheme — accredia.it (accessed 7 Oct 2026)
- Garante and Accredia — certification and accreditation under the GDPR — garanteprivacy.it (accessed 7 Oct 2026)
- Codice dei contratti pubblici, art. 100 and Allegato II.12 — qualification of public-works contractors (SOA) — accredia.it (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice