Italy CV format: the privacy clause, and what the GDPR and the Garante actually require
Italian CVs usually end with a signed line authorising data processing. Italian law says consent is not needed for a CV you send on your own initiative, and the version most templates copy cites a repealed article.1
Written 13 October 2026. CitedCV. How we write our guides
First check: does the employer give you its own form?
Before you decide how to end the CV, look at how the application reaches the employer. Many Italian companies take CVs through a 'Lavora con noi' page, which EURES Italy describes as the usual route for speculative applications. If that page shows its own privacy notice and tick boxes, those boxes are what counts; a sentence at the bottom of your PDF does not replace or override them. If you send the CV by email, the line at the end of the document is the only privacy statement the reader sees, and the rest of this page is about that line.
- Find out whether the employer uses an online form or an email address.
- On a form, read the notice and tick only the purposes you accept; a box for recruitment and a box for marketing are separate choices.
- By email, choose one of the three endings in the table further down.
- If you keep a clause, sign it, as the Spanish public employment service's sheet on Italy advises, and write it in the language of the CV.
Where the clause comes from
Two public bodies still tell you to add it
EURES Italy, on its page dated 26 May 2026, says CVs sent to companies must contain permission for personal data processing in accordance with data protection law. The 2025 sheet on Italy from SEPE, Spain's public employment service, calls the consent at the end of the CV necessary and offers a standard formula. Both describe what Italian employers are used to seeing, and that expectation is real: a CV without the line can look incomplete to an Italian reader.
The formula most templates copy
SEPE's formula, rendered in Italian, reads: 'Autorizzo il trattamento dei dati personali contenuti nel mio curriculum vitae in base all'art. 13 del D.Lgs. 196/2003 e all'art. 13 del Regolamento UE 2016/679.' In English: I authorise the processing of the personal data in my CV under article 13 of Legislative Decree 196/2003 and article 13 of EU Regulation 2016/679. It cites two laws because Italy's privacy code of 2003 predates the GDPR, and the code was rewritten in 2018 to fit around it.
What the law text says, clause by clause
Each row takes one part of the common formula and sets it against the text of the law, read on 13 October 2026 in the consolidated privacy code published by the Garante per la protezione dei dati personali (which notes amendments up to Law 50 of 20 April 2026) and in the Garante's edition of the GDPR.
| Part of the formula | What the law text says | What that means for your CV |
|---|---|---|
| "art. 13 del D.Lgs. 196/2003" | The Garante's consolidated code lists Art. 13 (Informativa) as Abrogato, repealed, along with Art. 23 (Consenso). | The first reference points to an article that no longer exists. Drop it. |
| "art. 13 del Regolamento UE 2016/679" | GDPR Article 13 sets out what the controller must tell the person when it collects their data: identity, purposes, legal basis, recipients, retention, rights. | It is a duty of the employer, not a permission you give. Citing it in your own sentence does no harm but adds nothing. |
| "Autorizzo il trattamento" (consent) | Art. 111-bis of the code: for CVs sent spontaneously to start an employment relationship, the information is given at the first useful contact, and within the purposes of GDPR Art. 6(1)(b) consent to process the CV data is not due. | For a speculative CV, Italian law says the employer needs no consent from you to read and assess it. |
| The legal basis behind 111-bis | GDPR Art. 6(1)(b): processing is lawful when necessary for a contract, or for pre-contractual steps taken at the request of the person. | Assessing an application you sent fits that basis on the face of the text; the employer's own notice must name the basis it uses. |
| Consent, if you do give it | GDPR Art. 7(3): consent can be withdrawn at any time, as easily as it was given. Art. 7(4): consent tied to something it is not needed for is weighed when judging if it was free. | A line on your CV can be withdrawn by email later; a form that makes unrelated consent a condition is on weak ground. |
| Special categories | GDPR Art. 9(1) prohibits processing data revealing ethnic origin, political opinions, religious beliefs, union membership, health or sex life, unless an exception applies. | Leave these off the CV; consent in a footer is not a reason to include them. |
| How much data | GDPR Art. 5(1)(c): data must be adequate, relevant and limited to what is necessary. | A shorter personal block is the safer one: name, contacts, town. |
This is a reading of the published texts for applicants, not legal advice. Art. 111-bis speaks of CVs sent spontaneously; it does not mention CVs sent in reply to an advert, and no Garante guidance read for this page says how it applies to them.
Three ways to end an Italian CV
The three endings below are our suggestions, built from the rows above. None is wording that a law or the Garante prescribes.
| Option | Italian text | English meaning | When it fits |
|---|---|---|---|
| A. No clause | Nothing after the last section. | Nothing. | A speculative CV by email, if you accept that some Italian readers expect the line. Art. 111-bis makes consent unnecessary here. |
| B. The custom, corrected | Autorizzo il trattamento dei dati personali contenuti nel presente curriculum vitae ai fini della selezione del personale, ai sensi del Regolamento (UE) 2016/679 e del D.Lgs. 196/2003. | I authorise the processing of the personal data in this CV for recruitment, under Regulation (EU) 2016/679 and Legislative Decree 196/2003. | Most email applications. It meets the expectation EURES and SEPE describe, limits the purpose to recruitment and cites no repealed article. |
| C. Information only | Dati personali forniti ai fini della selezione del personale e trattati ai sensi del Regolamento (UE) 2016/679 e dell'art. 111-bis del D.Lgs. 196/2003. | Personal data provided for recruitment and processed under Regulation (EU) 2016/679 and Article 111-bis of Legislative Decree 196/2003. | When you prefer not to frame it as consent but want the reader to see you know the rule. |
Layout
Put the line at the very end, after the last section, in the body font at the same size or one point smaller, followed by place, date and your signature. On a Europass CV, add it as the last custom section, since the editor has no dedicated field for it; the Europass guide covers custom sections.
If you want to be removed later
Whether you gave consent or not, the GDPR rights in the employer's notice apply: access, correction, erasure and objection, plus a complaint to the Garante. If you did give consent, Art. 7(3) lets you withdraw it with one email.
What Italian law keeps off the CV in the first place
Art. 113 of the privacy code leaves two older labour rules in force, and both shape what a CV should not carry.
- Statuto dei lavoratori, Art. 8: an employer may not investigate, for hiring or during employment, a worker's political, religious or union opinions, or facts not relevant to assessing professional aptitude.
- D.Lgs. 276/2003, Art. 10: employment agencies and other authorised intermediaries may not process data or preselect workers, even with their consent, on beliefs, union or political affiliation, religion, sex, sexual orientation, marital or family status, pregnancy, age, disability, ethnic or national origin, health or disputes with past employers, unless the trait is an essential requirement of the job.
- The code of conduct for employment agencies, approved by the Garante and announced in its newsletter of 14 February 2024: member agencies collect online information only from professional social networks, and may not pass references from former employers to clients without the candidate's explicit prior authorisation.
SEPE's Italy sheet turns this into plain advice: no salary expectations, marital status, children, religion or politics on the CV, and no photo or copies of certificates unless the ad asks. EURES Italy also says a photo is not needed unless requested.
The rest of the Italian CV in brief
Length and order
SEPE's sheet asks for one page, two at most with long experience, education and experience in reverse chronological order, and the job title or goal at the top. It also notes that academic training is given weight in Italy.
Europass
SEPE calls the Europass CV fairly well accepted in Italy, and EURES Italy points to the Europass editor. Our Europass guide shows each field.
The cover letter goes in the email
For email applications, SEPE prefers the cover letter written in the body of the message rather than attached, keeping the CV as a PDF attachment.
Sources and the date read
| Source | Used for | Date |
|---|---|---|
| Garante, Codice in materia di protezione dei dati personali (testo coordinato, PDF) | Art. 13 and 23 repealed; Art. 111-bis; Art. 113 | Read 13 Oct 2026; notes amendments to April 2026 |
| Garante, GDPR text with references to the recitals | Arts 5, 6, 7, 9 and 13 | Read 13 Oct 2026 |
| Normattiva, Law 300/1970 Art. 8 and D.Lgs. 276/2003 Art. 10 | What employers and agencies may not ask | Read 13 Oct 2026 |
| Garante newsletter no. 518 | Code of conduct for employment agencies | 14 Feb 2024 |
| EURES, Living and working conditions: Italy | The clause expectation; photo | Page dated 26 May 2026 |
| SEPE, Herramientas de búsqueda de empleo en Italia | The common formula; length; letter in the email | 2025 edition |
Who this page is not for
- Applicants to Italian public bodies through a concorso: the call sets its own forms and declarations.
- Anyone looking for the work permit route for non-EU nationals: Italy's quota system (decreto flussi) was not checked for this page, so nothing here covers it.
- Employers writing their own privacy notice for candidates: the GDPR Art. 13 list above is the starting point, but a notice needs more than a CV footer.
Next steps
- Decide between endings A, B and C, and keep the same one in every CV you send in Italy.
- Remove anything Art. 9 or the Statuto puts off limits from the personal block.
- If your degree is foreign, add its recognition line; the degree recognition guide shows how.
- Send a PDF, with the letter in the email body.
CitedCV can draft the English version of the CV from facts you confirm, with EU conventions; it does not write Italian, and it does not add a privacy clause, so paste your chosen ending yourself.
Questions people ask
Do I need a privacy clause on my CV in Italy?
Not by law for a CV you send on your own initiative: Art. 111-bis of the Italian privacy code says consent is not due. Many employers still expect the line, so a corrected version is a safe choice.
What is the correct privacy clause for an Italian CV?
There is no official wording. A version that cites no repealed article reads: Autorizzo il trattamento dei dati personali contenuti nel presente curriculum vitae ai fini della selezione del personale, ai sensi del Regolamento (UE) 2016/679 e del D.Lgs. 196/2003.
Is art. 13 D.Lgs. 196/2003 still valid?
No. The consolidated privacy code published by the Garante lists Article 13 (Informativa) as repealed; the information duty now sits in Article 13 of the GDPR.
Does GDPR require consent to process a CV?
Not necessarily. GDPR Article 6(1)(b) allows processing needed for pre-contractual steps taken at your request, and Italian law adds that consent for spontaneously sent CVs is not due.
Where do I put the privacy clause on my CV?
At the very end, after the last section, followed by place, date and signature. On a Europass CV, add it as a final custom section.
Should I put a photo on an Italian CV?
Only if the ad asks for one. EURES Italy and the SEPE sheet on Italy both say a photo is not needed unless requested.
Can an Italian employer ask about my religion or marital status?
No, not for assessing you. Article 8 of the Statuto dei lavoratori bars inquiries into opinions and irrelevant facts, and agencies may not preselect on marital status even with consent.
Can I withdraw consent after sending my CV?
Yes. GDPR Article 7(3) lets you withdraw consent at any time, as easily as you gave it, so one email to the employer is enough.
Sources
- Garante per la protezione dei dati personali, Codice in materia di protezione dei dati personali (testo coordinato)www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9042678
- Garante per la protezione dei dati personali, Regolamento (UE) 2016/679 with references to the recitalswww.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9039802
- Garante per la protezione dei dati personali, Newsletter no. 518 of 14 February 2024www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9983384
- Normattiva, Legge 20 maggio 1970, n. 300, art. 8www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1970-05-20;300~art8
- Normattiva, Decreto legislativo 10 settembre 2003, n. 276, art. 10www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-09-10;276~art10
- EURES, Living and working conditions: Italyeures.europa.eu/living-and-working/living-and-working-conditions/living-and-working-conditions-italy_en
- SEPE, Herramientas de búsqueda de empleo en Italia (2025)www.sepe.es/SiteSepe/contenidos/personas/encontrar_empleo/encontrar_empleo_europa/pdf/2025/CV-y-CARTAS-de-PRESENTACION/2025_CV_Carta_Italia.pdf