Employee Monitoring Law Planner
Sources

Personal Data Protection Code, Italy Legislative Decree 196/2003

Law. Placed at Italy. Read 30 Sep 2026; 3 provisions cited by the planner.

Italian Privacy Code Art. 114Apply the Workers' Statute art. 4 guarantees to any remote monitoring

Art. 4 of Law 300/1970 on remote monitoring remains in force: equipment that can monitor workers remotely only for organisational and production needs, safety or asset protection and only after a union agreement or labour inspectorate authorisation, work tools and attendance recorders excepted, and use of the data only after adequate information to workers and in compliance with this Code. The Garante enforces art. 4 together with the GDPR principles (lawfulness, minimisation, storage limitation) in its decisions on video surveillance, email and internet use and geolocation.

What a reviewer asks to see: Art. 4 agreement or INL authorisation for each monitoring system; Worker information on the instruments and checks; Retention settings for footage, logs and metadata consistent with the purposes
Where monitoring plans usually fall short: Monitoring compliant with the Statute but not with GDPR minimisation or retention, or the reverse
Source: Personal Data Protection Code, Italy Legislative Decree 196/2003, read 30 Sep 2026
Italian Privacy Code Art. 171Do not breach the Workers' Statute rules on remote monitoring (art. 4(1)) or opinion inquiries (art. 8)

Breach of art. 4(1) (installing or using equipment capable of remote monitoring outside the permitted purposes or without the union agreement or labour inspectorate authorisation) or of art. 8 (inquiries into workers' opinions or irrelevant facts) of Law 300/1970 is a criminal offence punished with the penalties of art. 38 of that Law (fine or arrest from 15 days to one year, jointly in the most serious cases, with publication of the conviction).

What a reviewer asks to see: Legal sign-off before any monitoring system goes live, recording the art. 4 agreement or authorisation; Pre-employment screening scope approved against art. 8
Where monitoring plans usually fall short: Local managers installing cameras or trackers without central legal review
Source: Personal Data Protection Code, Italy Legislative Decree 196/2003, read 30 Sep 2026
Italian Privacy Code Art. 2-septies(7)Use biometrics for physical and logical access to data only within the safeguard measures

Consistently with the security obligations of GDPR art. 32, biometric data may be used in procedures for physical and logical access to data by authorised persons, in compliance with the data protection principles and the safeguard measures of this article.

What a reviewer asks to see: Access-control design showing biometrics used only to authenticate authorised persons to data or secure areas; Template storage and protection measures (on-card or encrypted templates)
Where monitoring plans usually fall short: Biometric access extended from secured data rooms to general building entry or attendance
Source: Personal Data Protection Code, Italy Legislative Decree 196/2003, read 30 Sep 2026

Open the full text on compliance.theartofservice.com

See the specimen plan run Plan your own list