Codice Fiscale, GDPR, and the Italian Sunshine Act: What Global Companies Need to Know About HCP Data in Italy

Italy has one of the most demanding HCP data environments in Europe. Understanding why, and what to do about it, is essential for any global life sciences company with commercial operations in the Italian market.

Since the enactment of Law 62/2022, the Italian Sunshine Act, companies transferring value to Italian healthcare professionals and healthcare organisations have been preparing for disclosure through the Registro Telematico, the centralised digital reporting platform to be established by the Italian Ministry of Health. As of July 2026, the register is not yet operational for active mandatory reporting, but the direction of travel is clear: once the implementing framework becomes operational, companies will need structured, accurate and reportable HCP/HCO data.

The principle is straightforward. The data requirements are not.

The Codice Fiscale Requirement

At the heart of Italian transparency reporting is the codice fiscale, the Italian fiscal code, equivalent to a national tax identification number. Every Italian resident has one, and the draft technical framework for the Registro Telematico places strong emphasis on recipient identification, including the codice fiscale for individual recipients where required.

For international companies, obtaining accurate codice fiscale data for the Italian HCPs they engage is often more difficult than it sounds. HCPs do not always proactively share this information. While the codice fiscale is a mandatory identifier for Italian Sunshine reporting, many healthcare professionals are reluctant to share it because it contains sensitive personal information, including elements derived from an individual’s date of birth and place of birth. As awareness of data privacy continues to grow, some doctors may hesitate to provide it unless they clearly understand why it is required and how it will be protected.

In cases where the codice fiscale is not readily available, it can often be generated. However, this is only possible when all the required data fields used to create it are available and accurate, such as the individual’s full legal name, date of birth, place of birth, and gender. Missing or incorrect information in any of these fields can prevent the codice fiscale from being generated correctly, creating additional challenges for data quality and reporting accuracy.

The codice fiscale encodes personal identifying information, including an individual’s date of birth, gender and place of birth, which can make some HCPs reluctant to share it. Although a codice fiscale can be generated, doing so requires accurate underlying data, including the individual’s full legal name, date and place of birth, and gender; without these fields, reliable identification remains difficult.

Building a Reliable Codice Fiscale Database

Approach	Information Required	How Companies Can Obtain or Generate It	Key Considerations
Direct collection from the HCP	Official codice fiscale provided by the healthcare professional	Collect it through HCP onboarding forms, contracts, registration forms or payment documentation	The company should clearly explain why the information is required and process it in accordance with GDPR requirements
Internal generation	Legal first name, legal surname, date of birth, gender, and municipality or foreign country of birth	Companies can develop an internal calculation tool or use appropriate software to generate the expected codice fiscale	A generated codice fiscale should be treated as provisional until it has been verified
External data provider	HCP identification details and available professional information	Use a specialised HCP data provider to obtain or enrich missing codice fiscale information	Companies should assess the provider’s data sources, accuracy, GDPR compliance and update procedures
Validation	Codice fiscale together with the HCP’s personal details	Validate the code using the Agenzia delle Entrate verification service or another authoritative source	A code may be structurally correct but still not correspond to the intended individual
Exception resolution	Official documentation or confirmation from the HCP	Contact the HCP directly when the generated or collected code cannot be validated	In cases of omocodia, the officially assigned codice fiscale may differ from the code produced through standard calculation
Database maintenance	Codice fiscale, source, validation status, validation date and supporting identifiers	Store the information in the company’s controlled HCP master-data system	Access should be restricted, changes documented and incomplete or unverified records regularly reviewed

The GDPR Consideration

Italian transparency reporting creates some tension with data protection requirements because transfer of value information relating to individual HCPs is personal data. However, where disclosure is required under the Italian Sunshine Act, companies have a legal obligation to collect and report the relevant information.

The main challenge is therefore not whether the data can be processed, but how the process is managed and communicated. Companies should ensure that HCPs and other stakeholders understand why the information is being collected, how it will be used, who will have access to it and when it may be disclosed.

Clear privacy notices, proportionate access controls and consistent internal processes remain important. Just as importantly, companies should communicate transparently with stakeholders so that mandatory reporting does not undermine trust or damage established professional relationships.

The objective is to meet the reporting obligation while maintaining confidence in how personal data is handled.

What the Telematic Register Will Require

The Registro Telematico is expected to require structured recipient identification and transfer of value (TOV) information. For individual HCP recipients, this means companies should be prepared to manage accurate identifying data, including codice fiscale where required, alongside details such as the date, value, nature and context of the transfer.

The categories matter. Companies should not assume that existing EFPIA, Farmindustria or internal transparency classifications will map perfectly to the Italian reporting structure. Government-managed reporting through the Registro Telematico is different from industry self-disclosure, and companies should be prepared for more formal validation, structured fields and tighter data-quality expectations.

For global companies accustomed to reporting under Farmindustria or EFPIA disclosure codes, The Italian Sunshine Act is unlikely to feel familiar; its expanded scope and several additional required fields may make it significantly more demanding than existing Farmindustria or EFPIA disclosure processes.The Registro Telematico is expected to be a government-managed platform, not an industry self-disclosure database, and the validation logic applied to submissions is likely to reflect regulatory requirements rather than industry consensus.

For more practical answers on scope, thresholds, timing and operational preparation, visit our Italian Sunshine Act FAQ section.

Building the Right Infrastructure for Italian Transparency Reporting

Global companies that try to manage Italian Sunshine Act compliance as an extension of their existing European transparency reporting workflow often find that the data requirements do not map cleanly. Some fields and requirements are specific to the Italian Sunshine Act, including intermediary identification and detailed personal HCP data, and may not exist in standard HCP master databases. Registro Telematico formatting may differ from what their platform generates for France, Belgium or other European markets.

The companies managing this well are those investing in Italian-specific HCP and HCO master data, including validated codice fiscale records where applicable, integrated into a compliance platform that can support the Registro Telematico’s expected submission requirements. That investment pays for itself quickly: clean data going in means cleaner reporting outputs, fewer validation issues, fewer internal escalations, and fewer last-minute corrections under deadline pressure.

Italy may not be the largest transparency reporting market, but it can be one of the least forgiving when HCP and HCO data is incomplete, fragmented or poorly structured. Build the required fields into your systems, establish strong relationships with relevant stakeholders to address data privacy concerns, and prepare for the Registro Telematico’s expected requirements, and Italian transparency reporting becomes a manageable, repeatable process rather than a twice-yearly scramble.

You can also explore our latest Italian Sunshine Reporting blogs for more guidance on data readiness, source systems, transparency reporting workflows and Sanità Trasparente preparation.

The Italian Touch: Identifying the Intermediary

One of the most distinctive features of the Italian Sunshine Act is the requirement to identify the intermediary involved in a reportable relationship. Companies must not only disclose the transfer of value made to an HCP or HCO; where applicable, they must also identify the person who defined the terms of the transfer or managed the relationship with the recipient on the company’s behalf.

This adds another layer of transparency beyond the payment itself. Intermediary identification can help show which individuals were involved in arranging the engagement, establishing its conditions or managing the relationship. Over time, this creates a clearer audit trail and gives companies greater visibility into the actors and decisions behind transfers of value.

For compliance teams, the intermediary is therefore not simply another reporting field. Capturing this information consistently can support internal monitoring, audit readiness and the broader objective of promoting transparent and ethical relationships with healthcare stakeholders.

Prepare Your HCP Data Before the Pressure Begins

Italian Sunshine Reporting’s final Sanità Trasparente Masterclass of 2026, sponsored by Vector Health, will take place in Milan on 24 September 2026.

Join us for a practical, hands-on session designed to help life sciences teams assess HCP/HCO data readiness, codice fiscale gaps, reporting workflows, internal controls and operational preparation before the Registro Telematico becomes active.

The session will feature speakers from Merqurio, OnlyLex and other notable Italian Sunshine and life sciences compliance experts.

Request your spot for the final 2026 Masterclass, or contact us to discuss your Italian Sunshine readiness and how Vector Health’s solutions can support your team.

Italy has one of the most demanding HCP data environments in Europe. Understanding why, and what to do about it, is essential for any global life sciences company with commercial operations in the Italian market.

Since the enactment of Law 62/2022, the Italian Sunshine Act, companies transferring value to Italian healthcare professionals and healthcare organisations have been preparing for disclosure through the Registro Telematico, the centralised digital reporting platform to be established by the Italian Ministry of Health. As of July 2026, the register is not yet operational for active mandatory reporting, but the direction of travel is clear: once the implementing framework becomes operational, companies will need structured, accurate and reportable HCP/HCO data.

The principle is straightforward. The data requirements are not.

The Codice Fiscale Requirement

At the heart of Italian transparency reporting is the codice fiscale, the Italian fiscal code, equivalent to a national tax identification number. Every Italian resident has one, and the draft technical framework for the Registro Telematico places strong emphasis on recipient identification, including the codice fiscale for individual recipients where required.

For international companies, obtaining accurate codice fiscale data for the Italian HCPs they engage is often more difficult than it sounds. HCPs do not always proactively share this information. While the codice fiscale is a mandatory identifier for Italian Sunshine reporting, many healthcare professionals are reluctant to share it because it contains sensitive personal information, including elements derived from an individual’s date of birth and place of birth. As awareness of data privacy continues to grow, some doctors may hesitate to provide it unless they clearly understand why it is required and how it will be protected.

In cases where the codice fiscale is not readily available, it can often be generated. However, this is only possible when all the required data fields used to create it are available and accurate, such as the individual’s full legal name, date of birth, place of birth, and gender. Missing or incorrect information in any of these fields can prevent the codice fiscale from being generated correctly, creating additional challenges for data quality and reporting accuracy.

The codice fiscale encodes personal identifying information, including an individual’s date of birth, gender and place of birth, which can make some HCPs reluctant to share it. Although a codice fiscale can be generated, doing so requires accurate underlying data, including the individual’s full legal name, date and place of birth, and gender; without these fields, reliable identification remains difficult.

Building a Reliable Codice Fiscale Database

The GDPR Consideration

Italian transparency reporting creates some tension with data protection requirements because transfer of value information relating to individual HCPs is personal data. However, where disclosure is required under the Italian Sunshine Act, companies have a legal obligation to collect and report the relevant information.

The main challenge is therefore not whether the data can be processed, but how the process is managed and communicated. Companies should ensure that HCPs and other stakeholders understand why the information is being collected, how it will be used, who will have access to it and when it may be disclosed.

Clear privacy notices, proportionate access controls and consistent internal processes remain important. Just as importantly, companies should communicate transparently with stakeholders so that mandatory reporting does not undermine trust or damage established professional relationships.

The objective is to meet the reporting obligation while maintaining confidence in how personal data is handled.

What the Telematic Register Will Require

The Registro Telematico is expected to require structured recipient identification and transfer of value (TOV) information. For individual HCP recipients, this means companies should be prepared to manage accurate identifying data, including codice fiscale where required, alongside details such as the date, value, nature and context of the transfer.

The categories matter. Companies should not assume that existing EFPIA, Farmindustria or internal transparency classifications will map perfectly to the Italian reporting structure. Government-managed reporting through the Registro Telematico is different from industry self-disclosure, and companies should be prepared for more formal validation, structured fields and tighter data-quality expectations.

For global companies accustomed to reporting under Farmindustria or EFPIA disclosure codes, The Italian Sunshine Act is unlikely to feel familiar; its expanded scope and several additional required fields may make it significantly more demanding than existing Farmindustria or EFPIA disclosure processes.The Registro Telematico is expected to be a government-managed platform, not an industry self-disclosure database, and the validation logic applied to submissions is likely to reflect regulatory requirements rather than industry consensus.

For more practical answers on scope, thresholds, timing and operational preparation, visit our Italian Sunshine Act FAQ section.

Building the Right Infrastructure for Italian Transparency Reporting

Global companies that try to manage Italian Sunshine Act compliance as an extension of their existing European transparency reporting workflow often find that the data requirements do not map cleanly. Some fields and requirements are specific to the Italian Sunshine Act, including intermediary identification and detailed personal HCP data, and may not exist in standard HCP master databases. Registro Telematico formatting may differ from what their platform generates for France, Belgium or other European markets.

The companies managing this well are those investing in Italian-specific HCP and HCO master data, including validated codice fiscale records where applicable, integrated into a compliance platform that can support the Registro Telematico’s expected submission requirements. That investment pays for itself quickly: clean data going in means cleaner reporting outputs, fewer validation issues, fewer internal escalations, and fewer last-minute corrections under deadline pressure.

Italy may not be the largest transparency reporting market, but it can be one of the least forgiving when HCP and HCO data is incomplete, fragmented or poorly structured. Build the required fields into your systems, establish strong relationships with relevant stakeholders to address data privacy concerns, and prepare for the Registro Telematico’s expected requirements, and Italian transparency reporting becomes a manageable, repeatable process rather than a twice-yearly scramble.

You can also explore our latest Italian Sunshine Reporting blogs for more guidance on data readiness, source systems, transparency reporting workflows and Sanità Trasparente preparation.

The Italian Touch: Identifying the Intermediary

One of the most distinctive features of the Italian Sunshine Act is the requirement to identify the intermediary involved in a reportable relationship. Companies must not only disclose the transfer of value made to an HCP or HCO; where applicable, they must also identify the person who defined the terms of the transfer or managed the relationship with the recipient on the company’s behalf.

This adds another layer of transparency beyond the payment itself. Intermediary identification can help show which individuals were involved in arranging the engagement, establishing its conditions or managing the relationship. Over time, this creates a clearer audit trail and gives companies greater visibility into the actors and decisions behind transfers of value.

For compliance teams, the intermediary is therefore not simply another reporting field. Capturing this information consistently can support internal monitoring, audit readiness and the broader objective of promoting transparent and ethical relationships with healthcare stakeholders.

Prepare Your HCP Data Before the Pressure Begins

Italian Sunshine Reporting’s final Sanità Trasparente Masterclass of 2026, sponsored by Vector Health, will take place in Milan on 24 September 2026.

Join us for a practical, hands-on session designed to help life sciences teams assess HCP/HCO data readiness, codice fiscale gaps, reporting workflows, internal controls and operational preparation before the Registro Telematico becomes active.

The session will feature speakers from Merqurio, OnlyLex and other notable Italian Sunshine and life sciences compliance experts.

Request your spot for the final 2026 Masterclass, or contact us to discuss your Italian Sunshine readiness and how Vector Health’s solutions can support your team.

FAQs

FAQ What is the codice fiscale in Italian Sunshine reporting?
The codice fiscale is the Italian fiscal code used to identify individuals in Italy. For Italian Sunshine Act readiness, companies should ensure that HCP records include accurate identifying information, including codice fiscale where required.

FAQ Is the Registro Telematico operational?
As of July 2026, the Registro Telematico, also known as Sanità Trasparente, is not yet operational for active mandatory reporting. Companies are nevertheless expected to prepare their data, workflows and controls before the implementing framework becomes operational.

FAQ Why does GDPR matter for Italian Sunshine reporting?
Transfer of value data linked to individual HCPs is personal data. Companies must therefore manage collection, storage, disclosure and retention in line with GDPR requirements, including legal basis, transparency, access controls and accountability.

FAQ What HCP data should companies prepare for the Italian Sunshine Act?
Companies should review HCP/HCO master data, codice fiscale records, medical licence numbers, specialty classifications, transfer of value categories, source systems, reporting workflows and internal approval controls.

FAQ How is Italian Sunshine reporting different from EFPIA or Farmindustria disclosure?
Italian Sunshine reporting is expected to use a government-managed Registro Telematico, not an industry self-disclosure database. Existing EFPIA or Farmindustria classifications may be useful, but companies should not assume they will map perfectly to the Italian reporting structure.