Codice Fiscale, GDPR, and the Italian Sunshine Act: What Global Companies Need to Know About HCP Data in Italy

Italy has one of the most demanding HCP data environments in Europe. Understanding why, and what to do about it, is essential for any global life sciences company with commercial operations in the Italian market.

Since the enactment of Law 62/2022, the Italian Sunshine Act, companies transferring value to Italian healthcare professionals and healthcare organisations have been preparing for disclosure through the Registro Telematico, the centralised digital reporting platform to be established by the Italian Ministry of Health. As of July 2026, the register is not yet operational for active mandatory reporting, but the direction of travel is clear: once the implementing framework becomes operational, companies will need structured, accurate and reportable HCP/HCO data.

The principle is straightforward. The data requirements are not.

The Codice Fiscale Requirement

At the heart of Italian transparency reporting is the codice fiscale, the Italian fiscal code, equivalent to a national tax identification number. Every Italian resident has one, and the draft technical framework for the Registro Telematico places strong emphasis on recipient identification, including the codice fiscale for individual recipients where required.

For international companies, obtaining accurate codice fiscale data for the Italian HCPs they engage is often more difficult than it sounds. HCPs do not always proactively share this information. Medical registries and professional associations may hold it, but access is not always straightforward. And because the Italian Sunshine Act is structured around periodic reporting of transfers, gaps in codice fiscale data can have a direct impact on the completeness and accuracy of future reporting.

Companies without a reliable source of validated Italian HCP data, including codice fiscale, medical licence numbers and specialty classifications, are effectively flying blind going into each reporting cycle.

The GDPR Complication

Italy’s transparency reporting obligations sit alongside European data protection law. Transfer of value data relating to individual HCPs is personal data, and its collection, storage, use and disclosure must be managed in line with GDPR requirements, including legal basis, transparency, data minimisation, access controls, retention and accountability.

The Italian Sunshine Act addresses transparency by linking disclosure obligations to the underlying legal framework for reporting. However, this does not remove the need for GDPR-compliant data governance. Companies still need clear privacy notices, documented processing purposes, appropriate access controls, retention rules, and procedures for handling data subject rights.

For compliance teams, this creates a documentation burden that is easy to underestimate. The same HCP interaction record that may feed a future Registro Telematico submission also needs to satisfy GDPR accountability requirements. If compliance infrastructure treats Sunshine reporting and data protection as separate concerns, it may create unnecessary risk.

What the Telematic Register Will Require

The Registro Telematico is expected to require structured recipient identification and transfer of value (TOV) information. For individual HCP recipients, this means companies should be prepared to manage accurate identifying data, including codice fiscale where required, alongside details such as the date, value, nature and context of the transfer.

The categories matter. Companies should not assume that existing EFPIA, Farmindustria or internal transparency classifications will map perfectly to the Italian reporting structure. Government-managed reporting through the Registro Telematico is different from industry self-disclosure, and companies should be prepared for more formal validation, structured fields and tighter data-quality expectations.

For global companies accustomed to reporting under Farmindustria or EFPIA disclosure codes, the Italian Sunshine Act’s reporting structure may feel familiar in principle but different in practice. The Registro Telematico is expected to be a government-managed platform, not an industry self-disclosure database, and the validation logic applied to submissions is likely to reflect regulatory requirements rather than industry consensus.

For more practical answers on scope, thresholds, timing and operational preparation, visit our Italian Sunshine Act FAQ section.

Building the Right Infrastructure for Italian Transparency Reporting

Global companies that try to manage Italian Sunshine Act compliance as an extension of their existing European transparency reporting workflow often find that the data requirements do not map cleanly. Codice fiscale fields may not exist in their standard HCP master data. GDPR documentation requirements may sit outside their normal transparency reporting process. Registro Telematico formatting may differ from what their platform generates for France, Belgium or other European markets.

The companies managing this well are those investing in Italian-specific HCP and HCO master data, including validated codice fiscale records where applicable, integrated into a compliance platform that can support the Registro Telematico’s expected submission requirements. That investment pays for itself quickly: clean data going in means cleaner reporting outputs, fewer validation issues, fewer internal escalations, and fewer last-minute corrections under deadline pressure.

Italy may not be the largest transparency reporting market, but it can be one of the least forgiving when HCP and HCO data is incomplete, fragmented or poorly structured. Get the codice fiscale right, align GDPR processes with reporting obligations, and build for the Registro Telematico’s expected requirements, and Italian transparency reporting becomes a manageable, repeatable process rather than a twice-yearly scramble.

You can also explore our latest Italian Sunshine Reporting blogs for more guidance on data readiness, source systems, transparency reporting workflows and Sanità Trasparente preparation.

Prepare Your HCP Data Before the Pressure Begins

Italian Sunshine Reporting’s final Sanità Trasparente Masterclass of 2026, sponsored by Vector Health, will take place in Milan on 24 September 2026.

Join us for a practical, hands-on session designed to help life sciences teams assess HCP/HCO data readiness, codice fiscale gaps, reporting workflows, internal controls and operational preparation before the Registro Telematico becomes active.

The session will feature speakers from Merqurio, OnlyLex and other notable Italian Sunshine and life sciences compliance experts.

Request your spot for the final 2026 Masterclass, or contact us to discuss your Italian Sunshine readiness and how Vector Health’s solutions can support your team.

Italy has one of the most demanding HCP data environments in Europe. Understanding why, and what to do about it, is essential for any global life sciences company with commercial operations in the Italian market.

Since the enactment of Law 62/2022, the Italian Sunshine Act, companies transferring value to Italian healthcare professionals and healthcare organisations have been preparing for disclosure through the Registro Telematico, the centralised digital reporting platform to be established by the Italian Ministry of Health. As of July 2026, the register is not yet operational for active mandatory reporting, but the direction of travel is clear: once the implementing framework becomes operational, companies will need structured, accurate and reportable HCP/HCO data.

The principle is straightforward. The data requirements are not.

The Codice Fiscale Requirement

At the heart of Italian transparency reporting is the codice fiscale, the Italian fiscal code, equivalent to a national tax identification number. Every Italian resident has one, and the draft technical framework for the Registro Telematico places strong emphasis on recipient identification, including the codice fiscale for individual recipients where required.

For international companies, obtaining accurate codice fiscale data for the Italian HCPs they engage is often more difficult than it sounds. HCPs do not always proactively share this information. Medical registries and professional associations may hold it, but access is not always straightforward. And because the Italian Sunshine Act is structured around periodic reporting of transfers, gaps in codice fiscale data can have a direct impact on the completeness and accuracy of future reporting.

Companies without a reliable source of validated Italian HCP data, including codice fiscale, medical licence numbers and specialty classifications, are effectively flying blind going into each reporting cycle.

The GDPR Complication

Italy’s transparency reporting obligations sit alongside European data protection law. Transfer of value data relating to individual HCPs is personal data, and its collection, storage, use and disclosure must be managed in line with GDPR requirements, including legal basis, transparency, data minimisation, access controls, retention and accountability.

The Italian Sunshine Act addresses transparency by linking disclosure obligations to the underlying legal framework for reporting. However, this does not remove the need for GDPR-compliant data governance. Companies still need clear privacy notices, documented processing purposes, appropriate access controls, retention rules, and procedures for handling data subject rights.

For compliance teams, this creates a documentation burden that is easy to underestimate. The same HCP interaction record that may feed a future Registro Telematico submission also needs to satisfy GDPR accountability requirements. If compliance infrastructure treats Sunshine reporting and data protection as separate concerns, it may create unnecessary risk.

What the Telematic Register Will Require

The Registro Telematico is expected to require structured recipient identification and transfer of value (TOV) information. For individual HCP recipients, this means companies should be prepared to manage accurate identifying data, including codice fiscale where required, alongside details such as the date, value, nature and context of the transfer.

The categories matter. Companies should not assume that existing EFPIA, Farmindustria or internal transparency classifications will map perfectly to the Italian reporting structure. Government-managed reporting through the Registro Telematico is different from industry self-disclosure, and companies should be prepared for more formal validation, structured fields and tighter data-quality expectations.

For global companies accustomed to reporting under Farmindustria or EFPIA disclosure codes, the Italian Sunshine Act’s reporting structure may feel familiar in principle but different in practice. The Registro Telematico is expected to be a government-managed platform, not an industry self-disclosure database, and the validation logic applied to submissions is likely to reflect regulatory requirements rather than industry consensus.

For more practical answers on scope, thresholds, timing and operational preparation, visit our Italian Sunshine Act FAQ section.

Building the Right Infrastructure for Italian Transparency Reporting

Global companies that try to manage Italian Sunshine Act compliance as an extension of their existing European transparency reporting workflow often find that the data requirements do not map cleanly. Codice fiscale fields may not exist in their standard HCP master data. GDPR documentation requirements may sit outside their normal transparency reporting process. Registro Telematico formatting may differ from what their platform generates for France, Belgium or other European markets.

The companies managing this well are those investing in Italian-specific HCP and HCO master data, including validated codice fiscale records where applicable, integrated into a compliance platform that can support the Registro Telematico’s expected submission requirements. That investment pays for itself quickly: clean data going in means cleaner reporting outputs, fewer validation issues, fewer internal escalations, and fewer last-minute corrections under deadline pressure.

Italy may not be the largest transparency reporting market, but it can be one of the least forgiving when HCP and HCO data is incomplete, fragmented or poorly structured. Get the codice fiscale right, align GDPR processes with reporting obligations, and build for the Registro Telematico’s expected requirements, and Italian transparency reporting becomes a manageable, repeatable process rather than a twice-yearly scramble.

You can also explore our latest Italian Sunshine Reporting blogs for more guidance on data readiness, source systems, transparency reporting workflows and Sanità Trasparente preparation.

Prepare Your HCP Data Before the Pressure Begins

Italian Sunshine Reporting’s final Sanità Trasparente Masterclass of 2026, sponsored by Vector Health, will take place in Milan on 24 September 2026.

Join us for a practical, hands-on session designed to help life sciences teams assess HCP/HCO data readiness, codice fiscale gaps, reporting workflows, internal controls and operational preparation before the Registro Telematico becomes active.

The session will feature speakers from Merqurio, OnlyLex and other notable Italian Sunshine and life sciences compliance experts.

Request your spot for the final 2026 Masterclass, or contact us to discuss your Italian Sunshine readiness and how Vector Health’s solutions can support your team.

FAQs

FAQ What is the codice fiscale in Italian Sunshine reporting?
The codice fiscale is the Italian fiscal code used to identify individuals in Italy. For Italian Sunshine Act readiness, companies should ensure that HCP records include accurate identifying information, including codice fiscale where required.

FAQ Is the Registro Telematico operational?
As of July 2026, the Registro Telematico, also known as Sanità Trasparente, is not yet operational for active mandatory reporting. Companies are nevertheless expected to prepare their data, workflows and controls before the implementing framework becomes operational.

FAQ Why does GDPR matter for Italian Sunshine reporting?
Transfer of value data linked to individual HCPs is personal data. Companies must therefore manage collection, storage, disclosure and retention in line with GDPR requirements, including legal basis, transparency, access controls and accountability.

FAQ What HCP data should companies prepare for the Italian Sunshine Act?
Companies should review HCP/HCO master data, codice fiscale records, medical licence numbers, specialty classifications, transfer of value categories, source systems, reporting workflows and internal approval controls.

FAQ How is Italian Sunshine reporting different from EFPIA or Farmindustria disclosure?
Italian Sunshine reporting is expected to use a government-managed Registro Telematico, not an industry self-disclosure database. Existing EFPIA or Farmindustria classifications may be useful, but companies should not assume they will map perfectly to the Italian reporting structure.