Privacy and GDPR for Employees (Italy)

The GDPR requires the controller to adopt appropriate technical and organisational measures, and says that anyone who processes data under the controller's authority may do so only on its instructions (Articles 24, 29 and 32). The law does not, however, name a particular course, duration or certificate. Instructing and training staff is a common way of meeting these rules, but it is the employer who decides how. This course is not required by law as such and is not enough, on its own, to discharge any specific duty of the controller.

No. It is a certificate of completion: it shows that you have taken this course and passed the test. It is not a regulated or accredited qualification, and the course has not been assessed or approved by the Garante per la protezione dei dati personali (the Italian data protection authority) or any other authority. It does not make you a data protection officer (DPO). Your employer decides whether the training is enough for its needs.

The controller is the company, and this course does not take its place. It must still designate in writing who processes data and give instructions (Article 29 GDPR; Article 2-quaterdecies of the Codice privacy, the Italian data protection code), draw up privacy notices, keep the record of processing activities where required, set internal procedures on access, retention, requests from data subjects and breaches, regulate its relationships with external suppliers, assess risks, carry out a data protection impact assessment where needed and appoint a DPO in the cases provided for, notifying the Garante of the contact details. People who work with health, personnel or marketing data also need instructions on their own tools.

Regulation (EU) 2016/679 (GDPR) and the Codice in materia di protezione dei dati personali (Legislative Decree 196/2003, amended by Legislative Decree 101/2018): the age of consent for minors (Article 2-quinquies), designated persons (Article 2-quaterdecies), data on convictions and offences (Article 2-octies), monitoring of workers (Article 114 and Article 4 of the Statuto dei lavoratori, the Workers' Statute), the ban on inquiries into opinions (Article 8 of the Statuto), data subjects' rights, security, personal data breaches and penalties. The rules can change: you will find the current texts on the Garante's website (garanteprivacy.it).

Yes. The Garante per la protezione dei dati personali can issue a reprimand, restrict or ban processing and impose administrative fines of up to 20 million euros or 4 % of worldwide annual turnover for the most serious infringements (Article 83 GDPR). The most serious infringements can also be criminal offences punished by a criminal court (Article 167 and following of the Codice). The last lesson explains the difference.

The course explains the rules that apply in every workplace. Some sectors have extra rules, for example healthcare, schools, public administration and banking. Ask your manager which instructions and systems apply in your company.

Most people take about an hour for the eight lessons and the 25-question test. You can take a break and carry on later from the same device.

It costs nothing. You see which lessons to read again and can retake the test as often as you like.

Only after you have passed the test: €12 for the PDF certificate. The course and the test are free.

Every certificate has a number and a QR code. Anyone who scans the code or enters the number on our verification page sees your name, the course and the date you passed the test.

No rule sets an expiry date for this kind of certificate. We show it as valid for 24 months from the date of the test, because rules, tools and procedures change. Your employer may ask for a refresher sooner or later.