Transfer 03 / personal data
Law 81 and ANTAI guidance are the official starting point. The project still needs a factual data map and approved decisions; a footer policy alone cannot prove responsible handling.
Record every personal-data field, source, purpose, system, role, access level, vendor, location, transfer, retention period, backup, deletion path, and AI use.
Implement approved notices and permissions, request handling, access controls, authentication, logs, security, vendor instructions, incident escalation, and a responsible human contact.
The client and qualified adviser determine Law 81 and sector requirements. Engineering implements and tests the approved behavior without claiming ANTAI certification.