GDPR and payroll data with Italian ICPs: FAQ on roles, transfers and retention

Global EOR and payroll platforms that work with an Italian in-country partner (ICP) share employee data across borders every month. Partnership and operations teams ask the same questions again and again. This FAQ answers them in plain terms.

It is not legal advice. It sets out how the roles usually work, so your teams can ask better questions during due diligence.

Roles  

Who is the controller and who is the processor?  

It depends on who decides why and how the data is used. Do not assume one answer for the whole relationship.

In many EOR setups, your platform is the employer of record or the contracting party with the client. It decides which data it needs and why. In that case it is a controller for the employee data it collects.

The Italian ICP often runs payroll calculation, filings and social security reporting on your instructions. For that work it usually acts as a processor.

The ICP may also be a controller in its own right. It has its own legal duties in Italy. It must keep certain records and file certain declarations with Italian bodies. For those duties it decides the purpose, because the law does. That makes it a controller for that part.

So the honest answer is often a mix. Write it down per processing activity, not per contract.

Do we need a data processing agreement?  

Yes, wherever the ICP acts as a processor. The agreement must set out the subject matter, the type of data, the instructions, confidentiality, security measures, sub-processor rules, assistance with data subject requests, and deletion or return at the end.

Where the ICP is an independent controller for its legal duties, a processor agreement is the wrong tool. Use a clear allocation of responsibilities instead, and say so in the contract.

Are we joint controllers?  

Rarely, but it happens. If both sides jointly decide the purposes and means for the same processing, the joint controller rules apply. Then you must agree who handles transparency and data subject requests. Check this when you build shared portals or shared employee records.

Transfers  

Does data moving between us and the ICP count as a transfer?  

It depends on where each party sits.

If your platform and the ICP are both inside the EU or EEA, the data stays within the area where GDPR applies directly. No special transfer tool is needed for the movement itself.

If your platform is outside the EU, data sent from Italy to you is a restricted transfer. You need a valid transfer basis. That can be an adequacy decision for your country, or standard contractual clauses with a transfer assessment, or another tool the regulation allows.

Data flowing from you to the ICP is also covered by GDPR when the ICP processes it in Italy for Italian employees.

What about your sub-processors?  

Map them. Hosting providers, payroll engines, support tools and analytics vendors all count. For each one, record the country where data is stored and the countries from which it can be accessed. Remote access from a third country is a transfer too.

The ICP will ask for this list. Have it ready, and agree how you will notify each other of changes.

Which data is sensitive in payroll?  

Payroll files carry more than names and salaries. They can hold health information through sick leave, union membership through deductions, family data through allowances, and tax identifiers. Treat these as high risk. Share the minimum, use encrypted channels, and restrict access by role.

Retention  

How long must payroll data be kept?  

Italian law sets minimum retention periods for payroll, tax and social security records. These are different from the GDPR principle that data should not be kept longer than needed. The two fit together: keep the data for the legal period, then delete it or anonymise it.

We do not state specific periods here. Ask the ICP to confirm the current periods per record type in writing. Build those into your retention schedule.

Who deletes what when the engagement ends?  

Agree this before you start. A workable pattern is:

• The ICP returns or deletes data held as a processor, as you instruct.
• The ICP keeps what Italian law requires it to keep as its own obligation, and says so.
• Both sides document the deletion and confirm it.

What about data subject requests?  

An employee may ask either party for access, correction or deletion. Set one intake route and a clear handover. Whoever receives the request forwards it fast. Deletion requests must be weighed against legal retention duties, and the answer to the employee should explain that.

What about breaches?  

Agree who notifies whom, and how fast. A processor must tell its controller without undue delay. A controller may have to notify the supervisory authority within the legal time limit. Put contact names and a channel in the contract, and test them.

A short checklist  

• Map each processing activity and name the role of each party.
• Sign the right agreement for each role.
• List sub-processors and data locations.
• Pick a transfer tool for any flow leaving the EU or EEA.
• Get retention rules per record type from the ICP.
• Define return, deletion and request handling.
• Define breach contacts.

Partnership teams that want to see how we structure these points in practice can request the data-exchange specification from ItalyInCountry.