Providers keep telephone traffic data for 24 months and telematic traffic data (never content) for 12 months from the communication, and unanswered call data for 30 days, for the detection and prosecution of crimes (Law 167/2017 art. 24 sets 72 months for terrorism and organised crime offences); the data are released only on a reasoned court decree (or, in urgency, a prosecutor's decree validated within 48 hours) for serious offences and grave telephone threats or harassment or to trace fugitives; preservation orders of up to 90 days (extendable to six months) must be complied with without delay and kept secret. Retention follows the Garante's general measure on quality, security and periodic destruction. Latest version in force from 30 January 2026.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.