The Italian law on artificial intelligence (AI), approved by l. no. 132 of 23 September 2025, contains significant provisions on data protection.
Among the general principles established by the law, it is first and foremost stipulated that the research, testing, development, adoption, application and use of AI systems and AI models for general purposes must be carried out in compliance with the protection of personal data.
Within the more specific provisions, of particular interest is the requirement for the consent of those exercising parental responsibility for the processing of personal data in the use of AI technologies by children under the age of fourteen, who may instead give their consent independently if they are at least this age, provided that the information and communications addressed to them are easily accessible and understandable.
Of particular importance are the provisions on scientific research and experimentation in the development of AI systems in the healthcare sector.
In this context, the Italian law provides for broad authorisation for the secondary use of personal data, including sensitive data, by public bodies, private non-profit organisations and IRCCS, as well as private individuals operating in the healthcare sector within the scope of projects involving the aforementioned categories. The obligation to provide information on data processing is simplified, as it can also be fulfilled by means of general information made available on the data controller's website. For such processing, notification to the Data Protection Authority is required, including information on compliance with the obligations of accountability, data protection by design and by default, and data protection impact assessment (DPIA) provided for by the GDPR, as well as the persons designated as “processors”, with a mechanism that enables the processing operations subject to notification to be carried out after 30 days, unless blocked by the Data Protection Authority (GPDP) within that period.
Furthermore, for these purposes, processing aimed at anonymising, pseudonymising or synthesising personal data, including sensitive data, is “always permitted”. On this point, specific guidelines are also to be adopted for anonymisation procedures and the creation of synthetic data by the AGENAS, subject to the opinion of the GPDP.
The new provisions aim to facilitate the reuse of personal data in the context of AI. However, their application requires careful coordination with other elements of personal data protection legislation, compliance with which remains essential in all cases.
Articoli Correlati