The House of Data Imperiali bulletins are extracts from the articles of the Legal Information Service (SIG) edited by Mr. Rosario Imperiali d’Afflitto.

The SIG is available by subscription only.

For further information, please email:

Whistleblowing: the Italian National Anti-corruption Authority’s Guidelines and the GDPR setting – 1

Regulatory framework

Directive (EU) 2019/1937 obliges member states to adopt in their legal systems specific guiding principles for horizontal regulation of the phenomenon of whistleblowing, reporting or public disclosure of situations that are against the law, of which employees become aware in their employment environment.

Italy has implemented these principles through Legislative Decree No. 24/2023, which contains a deep and unified reform, abrogating previous provisions on the subject (Legislative Decree 165/2001, Art. 54-bis).

The Italian National Anti-corruption Authority’s Guidelines

The decree grants investigative and coercive powers to the National Anti-Corruption Authority (ANAC), accordingly, requiring it to issue new guidelines regarding the protection of individuals who report violations and for procedures for the submission and handling of external disclosures.

The new ANAC guidelines replace those adopted by the same authority in Resolution No. 469/2021 under the previous framework. In addition to the specific area of external reporting, ANAC has carried out a series of in-depth studies on the scope of the reform, the protections and support measures recognized, the way in which reports are submitted, as well as on the links with the personal data protection framework.

At the same time, the Italian Official Gazette No. 164 of 7/15/2023 published the Regulation for the management of external whistleblowing and the enforcement of ANAC’s sanctioning power.

In addition to the requirements set forth in the whistleblowing reform, the principles of personal data protection apply for the relevant profiles, and the Italian Data Protection Authority has issued its opinion on two occasions, most recently, in a decision dated July 6, 2023 (web doc. no. 9912239).

In the body of this commentary, the purpose of which is to link both disciplines (of whistleblowing and of the protection of the related processing of personal data) the term “whistleblowing” also includes cases of public disclosure or reporting to the judicial authority, unless otherwise indicated.

Implementation timeframe

The new ANAC guidelines are effective from July 15, 2023, coinciding with the entry into force of Decree No. 24/2023, that is, they apply from reports sent and received after July 14, 2023.

More specifically, the decree provides two separate time thresholds for effectiveness:

  • That of July 15, 2023, for companies and entities that employed an average of at least 250 employees or collaborators in the past year
  • That of December 17, 2023, for others that employed fewer than 250 employees or collaborators in the past year.

For reports submitted before July 15, 2023, on the other hand, the previous regime will continue to apply, along with the ANAC guidelines covered by Resolution No. 469/2021.