TL;DR
Fifty new rules: 17 in healthcare, 12 on anti-money-laundering, 21 across banking, insurance, capital markets, pharmacy and video surveillance. Each cites its source. All start as «A confirmar».
The gap was not generic: it was in seven domains
Opening the Italian matrix for a healthcare client returned six rules. On the same screen, a Portuguese client got twenty-three. This was not a difference in style: these are the sectors that in Portugal have their own retention rule — blood, transplants, assisted reproduction, radiation, vaccines, screening, pathology — and that have the same in Italy, except the matrix did not carry them.
Anti-money-laundering was a single line, repeated
The worst case was the AML domain: four rules, two of which said the same thing, the ten years of Art. 31 of Legislative Decree 231/2007. Everything the decree imposes around that period was missing, and each of those is a processing activity in its own right: the perimeter of identification data, the beneficial owner, politically exposed persons, the reasoning behind a decision not to report, the suspension ordered by the FIU, the internal reporting channel, payer data in transfers. The last of these carries a European five-year period that coexists with the national ten years for the same client: leaving them implicit in one entry means writing a register that describes a single processing activity.
- Healthcare from 6 to 23 rules: reports and histological preparations, diagnostic imaging, radiation dose, haemovigilance, tissue transplants, assisted reproduction, infectious diseases, screening, vaccination registry, telemedicine, genetic data, emergency care, surgical registers.
- AML from 4 to 16, five sectors realigned: banking from 2 to 8, insurance from 2 to 7, capital markets from 2 to 6, pharmacy from 3 to 5, video surveillance from 9 to 13.
- Only peripheral domains remain below Portugal — regulated professions, civil aviation, funeral services — three rules apart each.
Why they all start as «A confirmar»
None of the fifty was re-read in the official gazette by the person who wrote it. The source is cited so it can be checked in a minute, not because it has already been checked. Status moves to «Verified» when an Italian professional consults the primary source, and it stays visible to whoever reads the matrix: of the 232 Portuguese rules, 137 are verified and 95 are not, and you can see it.
The automated check that runs alongside the matrix found, during this work, three pre-existing Italian rules where the type of period did not match the declared structure, and an article still saying 611 rules when there were 661. Small defects that nobody had reported: which is precisely why a hand-typed number, in a product that grows, ages in silence.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
