Italy

The controller notifies the Garante without undue delay and, where possible, within 72 hours of becoming aware, unless the breach is unlikely to risk individuals' rights; late notices must give reasons. Notification goes through the Garante's online portal. Breaches posing a high risk must also be communicated to the individuals affected, and all breaches must be documented.

Private entities averaging at least 50 employees, entities in sensitive sectors such as financial services and AML, and entities with 231/2001 models must set up internal channels; for those with up to 249 employees the duty applies from 17 December 2023. ANAC acknowledges external reports within 7 days and gives feedback within 3 months (6 months if justified), and fines EUR 10,000 to 50,000 for retaliation, obstruction, confidentiality breaches or missing channels. Art. 12(8) removes reports from access under Law 241/1990.

Part Three, Section I of the Banca d'Italia provisions requires an independent, adequately resourced AML function and a named AML head who is a natural person with suitable independence, authority and skills. The appointment or removal of the head is notified to the Banca d'Italia within 20 days (para. 1.6(a)). The function also runs an annual risk self-assessment.

Due diligence applies when a continuing relationship is established, for occasional transactions at or above EUR 15,000 and fund transfers above EUR 1,000, on suspicion of money laundering or terrorist financing, and where earlier data is doubtful. Beneficial owners are identified with the client (Part Two, Section IV), with ongoing monitoring under Section VII. The provisions cite arts. 17, 19-26 and 42 of Legislative Decree 231/2007.