Pay transparency is one of the key innovations introduced by the recent legislation on equal treatment.

However, its practical implementation requires careful consideration of an aspect that often receives less attention: the handling of personal data related to compensation information.

Legislative Decree No. 96 of 7 May 2026, implementing Directive (EU) 2023/970, introduces new obligations for employers and grants employees enhanced access to pay-related information.

As a result, organisations are required to adopt operational measures that strike an appropriate balance between transparency and the protection of personal data.

The expansion of disclosure obligations inevitably entails the processing of personal data, making it essential to reconcile the objective of increasing transparency regarding potential pay disparities with the need to safeguard employees’ personal information.

The Decree expressly confirms the applicability of Regulation (EU) 2016/679 (GDPR), reiterating that any collection, processing, disclosure or dissemination of pay-related information must comply with the principles governing the protection of personal data.

Particular care must be taken with the information made available to employees.

While the legislation promotes greater transparency regarding average pay levels, it remains strictly prohibited to disclose information that would allow the remuneration of individual employees to be identified, whether directly or indirectly.

The risk of identifying individual employees is particularly significant in smaller organisations, where the publication of aggregated data could make it relatively easy to determine the remuneration of specific individuals.

For this reason, the legislator has provided that certain operational aspects will be further regulated through implementing decrees.

The legislation also establishes obligations that vary according to the size of the employer.

Certain requirements including indicating salary information in job advertisements, prohibiting employers from requesting candidates’ salary history, and recognising employees’ right to access information on average pay levels apply to all employers, regardless of the number of employees.

Larger organisations are subject to additional reporting obligations concerning the gender pay gap, with different reporting deadlines depending on the size of the workforce.

From a data protection perspective, organisations will need to ensure that their internal procedures comply with the new legal framework by updating privacy notices, data processing procedures, and the security measures adopted.

Attention should not be limited to formal compliance requirements alone but should also extend to the practical methods by which personal data are collected, stored, processed, and disclosed, ensuring that transparency obligations do not result in the improper disclosure of personal information.

A number of operational aspects remain subject to future implementing decrees, which will regulate, among other things, the methods for aggregating data, information flows to the competent public authorities, and the additional safeguards required by the Italian Data Protection Authority.

Companies should therefore begin reviewing their recruitment processes, compensation policies, and data protection documentation without delay, in order to be fully prepared for the full implementation of the new legislative framework.

The Law Firm remains at your disposal should you require any further information or assistance.