---
title: "Eurodac: the databases are interconnected, the data rules come later"
description: "Law 145/2026: article 13 interconnects Italy’s biometric databases and opens the national Eurodac access point. The decrees are due by 9 December 2026."
url: https://csidia.com/en/notes/eurodac-interconnessione-banche-dati-decreti/
lang: en
date: 2026-08-08
label: "Regulation"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/eurodac-interconnessione-banche-dati-decreti/
---

# Eurodac: the databases are interconnected, the data rules come later

Today, 8 August 2026, the Official Gazette (General Series No. 183) publishes Law No. 145 of 7 August 2026, converting Decree-Law No. 100 of 12 June 2026, “containing urgent measures on justice and for the implementation of the EU’s Pact on Migration and Asylum of 14 May 2024” (translated throughout from the Italian text). Conversion without amendments; the same issue carries the consolidated decree-law text, in force since 12 June. Inside a decree titled after justice and the EU Pact, Article 13 does something worth reading on its own terms: it interconnects existing databases and links them to a single national access point onto a European system. Here we look at the data architecture — not migration policy.

## What Article 13 provides

Paragraph 1: the automated fingerprint and facial-image identification system, from the digitisation of the Ministry of the Interior’s national identity register, “is interconnected with the data-processing centre” under Law No. 121 of 1981 — the Ministry’s CED.

Paragraph 2: the national access point sits at the Department of Public Security and “ensures communication to Eurodac of the data and information provided for by that regulation”. Six sources feed in: (1) the CED; (2) the fingerprint and facial-image system; (3) the system under Article 12(9-septies) of Legislative Decree 286/1998; (4) the residence-permit database; (5) the national asylum commission’s systems; (6) the Department for Civil Liberties and Immigration’s systems, for information on minors, status, and Italian citizenship.

The regulation, Article 3(4), is precise on cardinality: “Each Member State shall have a single national access point. Europol shall have a single access point (the Europol access point).” The infrastructure: it “shall use the existing network of the trans-European services for telematics between administrations (TESTA)”, and “personal data transmitted to or from Eurodac shall be encrypted”.

## What is still missing

Interconnection is provided for; the rules governing it are deferred. Article 13(3)(c) assigns the implementing decrees the task of setting, for the purposes of Articles 48, 50 and 51: “the procedures for adopting the measures necessary to guarantee data security, including the related security plan”; “the procedures for transferring data to third countries for return purposes”; “the procedures for logging and documentation”. Point (d) adds “the technical arrangements for accessing, entering, updating, consulting, amending and deleting data”.

Paragraph 4 sets the deadline: the decrees “shall be issued, after consulting the Data Protection Authority, within one hundred and eighty days of this decree’s entry into force”. One hundred and eighty days from 12 June 2026 fall on 9 December 2026 — our own calculation, not a date written into the law. One clarification changes how this reads: Articles 48, 50 and 51 of the regulation are already directly applicable, and the decrees exist to give them national effect. The obligation is not missing. What is missing is the written procedure for discharging it here.

## What the regulation asks of whoever holds the data

Article 48, “Data security”, requires “the necessary measures, including a data security plan”. Named controls: “physically protecting data, including by drawing up contingency plans for the protection of critical infrastructure”; “preventing data media from being read, copied, modified or removed without authorisation (data media control)”; “preventing unauthorised persons from using data-processing systems by means of data-transmission equipment (user control)”; “preventing the unauthorised entry of data and the unauthorised inspection, modification or deletion of personal data stored (storage control)”.

Article 51 requires every Eurodac comparison operation for law-enforcement purposes to be logged, to verify admissibility and lawfulness. Mandatory minimum content: “the exact purpose of the comparison request”; “the national file number”; “the exact date and time of the comparison request sent to Eurodac by the national access point”; “the name of the authority that requested the comparison and the official responsible who submitted the request and processed the data”; “the data used for the comparison” — a public list of what it means, technically, to log access to interconnected databases.

## How we check it

When a client interconnects two archives that were previously separate, the first question we ask is not whether it can be done, but which register will show — months later, in front of an inspection — who queried what, for what purpose, at what exact moment, and how that data is deleted once its purpose lapses. It is the scheme Article 51 sets out: purpose, file, date and time, responsible official, data used. We build it before the interconnection goes live, not after.

[See the service](https://csidia.com/en/solutions/data-protection) · [Talk to an engineer](https://csidia.com/en/contact)

## Third countries, and Chapter V

Article 50(2) anchors transfers to third countries for return purposes to the general framework: they “shall be carried out in accordance with the relevant provisions of Union law, in particular the provisions on data protection, including Chapter V of Regulation (EU) 2016/679, and, where applicable, readmission agreements, as well as the national law of the transferring Member State”. It is the only point where the Eurodac regulation explicitly defers to the general regime for transfers outside the EU.

## The people, and minors

The text, reported without comment. Article 14 of the regulation: “The biometric data of minors aged six or older shall be taken by officials specifically trained to carry out this task in a child-friendly and child-sensitive manner and in full respect of the best interests of the child and the safeguards laid down in the United Nations Convention on the Rights [...]”.

Article 10 of the decree-law: fact-finding checks and transmission to Eurodac “shall in any event be concluded within a maximum period of seventy-two hours”. For minors, “the relevant communications [...] are sent to the public prosecutor’s office at the juvenile court, and the procedures take place in the presence of an adult family member or, if the minor is an unaccompanied foreign minor or no adult family member can be found, in the presence of a representative or, where none has been appointed, a trained person”.

## The clause that avoids rewriting everything

Paragraph 5: “Where laws, regulations, decrees or other rules or measures refer to the Eurodac system under Regulation (EU) No. 603/2013, the reference shall be understood as referring to the ‘Eurodac system’ under Regulation (EU) 2024/1358”. A dynamic renvoi: every reference to the old Eurodac reads as a reference to the new one, without rewriting the instruments that cite it — a technique worth knowing for anyone maintaining an internal body of rules, though it shifts the work onto whoever keeps the cross-references current.

## What any other organisation takes from this

For any organisation unifying separate archives, Article 13 offers a reusable pattern:

- write the security plan before interconnection, not after the systems are already talking to each other;
- decide in advance the minimum content of every log entry: purpose, file, exact date and time, authority and official responsible, data used;
- design deletion alongside entry, not as an afterthought;
- treat cross-border transfers as a chapter of their own;
- date the assessment: an architecture is judged partly on when it was decided.

## Sources

- [Official Gazette — Law No. 145 of 7 August 2026 (General Series No. 183 of 8 August 2026)](https://www.gazzettaufficiale.it/eli/id/2026/08/08/26G00164/sg)
- [Official Gazette — consolidated text of Decree-Law No. 100 of 12 June 2026](https://www.gazzettaufficiale.it/eli/id/2026/08/08/26A04115/sg)
- [Normattiva — Decree-Law No. 100 of 12 June 2026, Articles 10 and 13](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legge:2026-06-12;100)
- [Regulation (EU) 2024/1358 (Eurodac), Articles 3, 14, 48, 50 and 51](https://eur-lex.europa.eu/legal-content/IT/TXT/?uri=CELEX:32024R1358)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/eurodac-interconnessione-banche-dati-decreti/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com