Data Protection and Privacy Law


Tonucci & Partners Data Protection team have extensive experience in the data protection sector regarding the application of Legislative Decree no.196 of 30 June 2003, Data protection code (the “Code”), the transposition of Directives 95/46/CE and 2002/58/CE and further changes.

The practice group assists clients operating in the public and private sectors, among which public and private health structures, companies operating on a National and International scale in various sectors such as retail, fashion, shoe production, pharmaceutical, airport and highway operation companies and tourism.

Specialized services involve:

  1. Revision of company policies to conform personal data processing to the provisions set out in the Code and provisions adopted by the Italian Data Protection Authority. The range of assistance is all-inclusive and covers data processing issues in particular sectors (public, health-care, judiciary, journalistic, labor and social welfare, electronic communications and new technologies – e-mail, sms, mms, RFID, etc. – video surveillance, etc.).
  2. Legal assistance to ensure that Clients’ data processing methods comply with the general Provisions adopted by the Data Protection Authority and the sector's Deontological Codes adopted by special categories of Data Controllers relative to specific types of data processing, among which data processing carried out:
    • for social security or for employment management purposes.
    • with equipment registering images, such as video surveillance.
    • for direct marketing or for sending advertising material, or to accomplish market research or interactive commercial communication or for commercial information purposes.
    • in the banking sector.
    • in private information systems to allow shopping credit, or to evaluate reliability and punctuality of payments.
    • by electronic communication and information services providers.
    • in the judiciary sector.
    • on personal data coming from archives, registries, lists, deeds or documents held by public entities.
    • for journalistic activities.
    • for historical or scientific research purposes.
    • for statistical purposes.
  3. Legal assistance in drafting deeds and "privacy models" (also web related) according to the Code provisions (privacy statements, agreement formulas if required, appointment of data processing responsible and/or Data Processor, "privacy policy" model formulas for web sites, deeds of appointment of the Italian representative of a foreign Data Controller, etc.).
  4. Assistance in administrative procedures as set out in the Code, especially for notification in advance of data processing (when required according to Article 37 of the Code) to be carried out with electronic means and submitted with electronic signature.
  5. Legal assistance in personal data processing matters represented by images (i.e. video-surveillance), sounds or multimedia elements (i.e.: processing of data sent via SMS or MMS, etc.).
  6. Legal assistance for the alignment of data processing with the minimum security measures set out in Articles 31-36 of the Code and in the Technical Disciplinary for minimum security measures (Annex B of the Code). The assistance focuses also on adequacy evaluation of company's security measures, and includes advice in drafting the Computer Security Program Document required by law in case of sensitive and/or judicial data processing performed with electronic instruments.
  7. Legal assistance in cross-border data transfers between EU countries and non-EU countries. Assistance includes: Model-contracts whose object is personal data exchange and data transfer to non-EU third Countries in compliance with the standard contractual clauses issued by the European Union following the Decision of the European Commission; data transfer to non-EU Member States in compliance with sector's agreements (i.e. "Safe Harbor agreement" between EU and United States) and with the General Authorizations issued by the Data Protection Authority and the EU Commission for data transfer toward third countries, including the application of the Binding Corporate Rules.
  8. Legal assistance in personal data processing matters performed through electronic communication networks (i.e. Internet, mobile phones, Wi-Fi technologies, terrestrial digital TV, RFID, etc.). The assistance in such area refers to the discipline contained in the Title X of the Code ("Electronic Communication") that has transposed the Directive 2002/58/EU (and further modifications) on data protection over networks and in the electronic communication services field. Furthermore, Tonucci & Partners provides assistance related to personal data protection issues connected to other directives (i.e., among the others: Legislative Decree 14 April 2003, no. 70, on the information society services, in reference to unsolicited commercial communications via e-mail) and offers specialized services aimed to guarantee a fair data processing over the Internet or other technology platforms used in connection with client's activities.
  9. Legal assistance with the Data Protection Authority
  10. Assistance in eventual ordinary litigation (administrative, criminal or civil proceedings), in case of violation of the Code.
  11. Assistance in specific data protection training for data processors and persons in charge of the processing.

Contact the Department

For further information, please contact the Department at


Find out more about our publications


Find out more