GDPR in Italy in 2026: privacy, cookies and whistleblowing

The GDPR has applied since 2018, yet in 2026 many Italian companies still have a privacy notice copied from a template, a cookie banner that blocks nothing and no whistleblowing channel at all. The basic rules have not changed this year. What has changed is the authorities' guidance, enforcement is ongoing, and Brussels is debating a reform. This guide sets out what is needed today, one obligation at a time.

The rules that apply

• GDPR (Regulation (EU) 2016/679): the principles, people's rights and the obligations of anyone processing personal data.
• Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018): the Italian rules, including marketing, cookies and employee data.
• The Italian Data Protection Authority's guidelines on cookies and tracking tools (10 June 2021), applicable since January 2022 and still in force.
• The whistleblowing decree (Legislative Decree 24/2023) and the guidelines of ANAC, the Italian anti-corruption authority.

1. The privacy notice

Whenever you collect personal data you must tell people who processes it, why and for how long (Articles 13 and 14 GDPR). The notice must state:

• the controller and its contact details, and the DPO if one has been appointed;
• the purposes and, for each one, the legal basis: contract, legal obligation, consent or legitimate interest (which must be explained);
• the recipients, including the providers that process data on your behalf (hosting, email, CRM, management software);
• any transfers outside the European Union and the safeguards in place;
• how long data is kept, in concrete terms rather than a vague "as long as necessary";
• the data subject's rights, including the right to complain to the Garante.

A notice on the website is not enough: employees, job applicants, customers and suppliers each need their own, and any video surveillance needs a sign. The most common mistake is a generic template that is never updated, listing providers no longer used and missing new ones.

2. Cookie banner and cookie policy

Technical cookies, needed for the site to work, require no consent but must be listed in the cookie policy. Everything else (advertising pixels, profiling, most third-party analytics, embedded videos and maps) may only start after consent. The Garante's guidelines set precise rules for the banner:

• closing the banner with the X counts as a refusal, and the X must be clearly visible;
• accept and reject must be equally prominent: no highlighted "Accept" button with the refusal tucked away;
• scrolling the page is not consent;
• in the detailed choices, non-essential categories start switched off;
• a cookie wall, letting in only those who accept, is generally unlawful;
• the banner must not reappear for six months, unless the cookies in use change;
• the choice must be recorded and changeable at any time, for example through a link in the footer.

Analytics can be treated like technical cookies only under strict conditions: aggregate data for that site alone, a masked IP address, and a provider that does not combine the data with anything else. With many third-party tools these conditions are hard to prove, and consent remains the safer choice.

The most frequent flaw is not the banner's wording but how it works: the message appears, but the tracking scripts run anyway on the first page load. It is also the first thing anyone checks, because the browser's developer tools are enough to see it.

For US services (analytics, newsletters, cloud) the reference is the EU-US Data Privacy Framework, in force since July 2023: transfers to certified companies are lawful. The EU General Court upheld it in September 2025 (case T-553/23), but the appeal to the Court of Justice (C-703/25 P) is still pending. It is worth knowing which of your providers are certified and keeping the standard contractual clauses as a fallback.

3. The other GDPR obligations

Record of processing activities

It is mandatory above 250 employees. Below that threshold it becomes mandatory if the processing is not occasional, involves special categories of data (such as health data) or criminal-offence data, or carries a risk. In practice almost every company with employees needs one, because personnel management is continuous. The Garante recommends it to everyone anyway, as the document that shows you know what data you process.

Providers, authorisations and security

Anyone processing data on your behalf (payroll consultant, software house, cloud provider, web agency) must be appointed as a processor under a contract (Article 28). Staff must be authorised and instructed. Security must match the risk (Article 32): personal accounts, two-factor authentication, updates and tested backups.

Data breaches

A breach that poses a risk to people must be notified to the Garante within 72 hours of becoming aware of it. If the risk is high, the people affected must be told too. Every breach, even one that is not notified, must be logged in an internal register.

DPIA and DPO

A data protection impact assessment (DPIA) is required for high-risk processing: extensive video surveillance, employee geolocation, large-scale profiling. A DPO is mandatory for public bodies and for organisations whose core activities involve large-scale monitoring of people or large-scale processing of special categories of data or criminal-offence data. For other SMEs it is optional.

Employees

Cameras and tools that allow remote monitoring require a union agreement or authorisation from the labour inspectorate (Article 4 of the Workers' Statute). For company email, the Garante sets 21 days as the period beyond which keeping the metadata of employees' emails generally requires the same safeguards.

Marketing

Promotional emails require consent. The exception is so-called soft spam: you may write to your customers about products similar to those they have bought, provided they can opt out at any time. Before phoning, the Italian do-not-call register (Registro pubblico delle opposizioni) must be checked, and since 2022 it covers mobile numbers too. Lists bought from third parties must be verified, because telemarketing remains one of the sectors the Garante fines most, in 2026 as well.

GDPR fines reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. For SMEs the most realistic risk is an inspection triggered by a complaint: a former employee, an annoyed customer, a newsletter nobody signed up for.

4. Whistleblowing: who needs a reporting channel

Legislative Decree 24/2023 requires an internal channel for reporting wrongdoing from:

• companies that employed an average of at least 50 people in the past year, on permanent or fixed-term contracts;
• companies that have adopted an organisational model under Legislative Decree 231/2001, whatever their size;
• certain sectors governed by the EU rules the decree refers to, such as financial services, anti-money-laundering and transport safety, even below 50 employees.

The channel must accept written reports, including through an online platform, and oral ones, by phone or voice message. On request, a face-to-face meeting must be possible. It must be set up after consulting the employee representatives and entrusted to an autonomous, trained person or office, or to an external provider. Companies with up to 249 employees may share one. Whoever runs it must:

• acknowledge receipt within 7 days;
• give feedback within 3 months;
• keep the identity of the reporter, of the people involved and the content confidential, including through encryption;
• publish clear information about the channel in a dedicated section of the website and make it visible in the workplace.

In its guidelines on internal channels (Resolution no. 478 of 26 November 2025), ANAC clarified that ordinary email and certified email (PEC) are not adequate in themselves. They are acceptable only with additional security measures, chosen on the basis of a risk assessment. In most cases a dedicated platform with encryption is the easiest solution to defend.

Whistleblowing is also personal data processing. The handling model must be based on a DPIA, reporters and the people involved must be informed, and reports may be kept for no more than five years after the procedure closes. ANAC can fine from 10,000 to 50,000 euros for failing to set up the channel, non-compliant procedures, retaliation and breaches of confidentiality.

5. Alongside the GDPR: NIS2 and accessibility

NIS2 (Legislative Decree 138/2024). It applies to companies in the sectors and of the sizes set by the decree, which must register with the National Cybersecurity Agency (ACN); registration is updated every year, from 1 January to 28 February. For those added to the list in 2025, incident notification has applied since January 2026: an early warning within 24 hours, a notification within 72. The basic security measures are due within 18 months of the Agency's notice, for most companies by October 2026.

Accessibility (Legislative Decree 82/2022, the European Accessibility Act). Since 28 June 2025, e-commerce and the other consumer services listed in the decree, such as banking and transport, must be accessible to people with disabilities. Microenterprises providing services are exempt; AgID, the Italian digital agency, is the supervisory authority.

What could change

In November 2025 the European Commission proposed the "Digital Omnibus", which would move the cookie rules into the GDPR, exempt some audience measurement from consent and introduce one-click refusal. As of October 2026 the proposal is still before the European Parliament's committees: nothing changes today, and the banner is still required.

Further along is "Omnibus IV" for small mid-cap companies. The Commission's proposal extends the exemption from the record of processing activities to organisations with up to 750 employees and limits it to high-risk processing. The text agreed in June 2026 awaits the Parliament's vote, expected in November. Until it is published in the EU Official Journal, the current rule applies.

Compliance that survives an inspection is the kind that matches what the company actually does: a flawless privacy notice is no use if the banner lets trackers run before consent.

Checklist

• Up-to-date privacy notices for the website, customers, employees and job applicants
• A cookie banner that blocks trackers until consent, with "Reject" as visible as "Accept"
• A cookie policy listing the cookies actually used, consistent with the banner
• A record of processing activities and contracts with the providers that process data
• A data breach procedure and a breach register
• A whistleblowing channel, where required, with a secure platform, a DPIA and a dedicated page on the website
• Documented consent for newsletters and marketing
• A check of NIS2 and accessibility obligations

Conclusion

GDPR compliance is not a document you sign once: it is a set of texts, settings and procedures that must stay in line with how the company works. The part that concerns the website (privacy notices, banner, cookie policy, contact forms) is also the most visible, and often the first to be checked.

This article is for information only, is up to date as of 12 October 2026 and does not constitute legal advice.