Checking an Italian individual: guarantor, partner or contractor, and UK GDPR

In short: a UK business can check an Italian individual when it has a specific, documented reason: a guarantee, a partner or director in a deal, or a contract with a sole trader or professional. Under UK GDPR you need a lawful basis (usually legitimate interests, Article 6(1)(f)), you should collect only what is necessary, and you may have to tell the person. Veryfy's Person Verification (€29) and Extended Person Verification (€49) are offered only for declared purposes, never for curiosity.

Part of the guide Checking an Italian company: a guide for UK businesses after Brexit. All guides: Guides.

When do you need to check a person rather than a company?

With a limited company the question is about the company. With an individual, the person is the counterparty and the person's own assets and record are what stand behind the deal. The three situations in which a UK business typically needs it are:

• A contract with a sole trader or self-employed professional, where there is no company between you and the individual. Our guide to the Italian sole trader explains why the owner is the debtor.
• A personal guarantee from an Italian director or shareholder, for a supply contract, a lease or a credit line.
• A partner or director joining a corporate or commercial transaction, such as a joint venture with an Italian entrepreneur.

These are the three declared purposes for which Veryfy offers the service. You declare which one applies before each check; the declaration documents the legitimate interest, but responsibility stays with whoever uses the data. Personal curiosity, checks on a partner or former partner, private disputes and any monitoring of a person outside a declared professional, guarantee or corporate relationship are excluded.

What does UK GDPR require of you?

Once a UK business receives personal data about an Italian individual, it is processing personal data. The points below come from the legislation and the regulator's guidance; whether they apply to your facts is a question for your data protection adviser.

• A lawful basis. Article 6(1)(f) of the UK GDPR allows processing that is necessary for the legitimate interests pursued by the controller or a third party, unless those interests are overridden by the individual's interests or fundamental rights (legislation.gov.uk: UK GDPR, Article 6).
• The three-part test. The ICO breaks legitimate interests into a purpose test, a necessity test and a balancing test, and says vague or generic business interests are not enough: you should have a clear and specific benefit or outcome in mind (ICO: what is the legitimate interests basis?). Accepting a guarantee for a specific contract is a specific purpose; vetting someone "just in case" is not.
• Data minimisation. Personal data must be adequate, relevant and limited to what is necessary for the purposes (Article 5(1)(c), legislation.gov.uk: UK GDPR, Article 5). If a Person Verification answers your question, you do not need the extended version.
• Telling the individual. Where data was not obtained from the person, Article 14 requires the controller to provide information such as its identity, the purposes and legal basis, and the categories of data. Article 14(5) disapplies this where, among other things, the person already has the information or providing it is impossible or would involve disproportionate effort (legislation.gov.uk: UK GDPR, Article 14). The simplest way to avoid the question is to say in your guarantee or onboarding documents that you will run these checks.

What does the check show?

Veryfy reports on a natural person

Product	Price	What it shows
Person Verification	€29	Protests, adverse records and insolvency proceedings against the person, from a public source, with the date of the check
Extended Person Verification	€49	Everything above, plus positions in other companies, shareholdings in other companies and properties in their name (Catasto, the land register, national search)

Every data point carries its source and date. The report shows public facts as they appear; it gives no judgement on the person and no prediction. The Italian protest register behind part of it holds, for each protest, the amount, the reason for non-payment and the debtor's identification, and keeps the entry for five years or until cancellation (Registro Imprese: protests). Each product comes with a free anti-scam check on the email, website and IBAN you were given. The reports are in Italian.

Which one for which situation?

A practical way to choose

Situation	What you need to know	Report
Small contract with a sole trader	Any protests or proceedings against the owner	Person Verification (€29)
Personal guarantee supporting a credit line	Whether the guarantor has other exposures and what they own	Extended Person Verification (€49)
New partner or director in a deal	Other positions and shareholdings, possible links	Extended Person Verification (€49), plus a company report on the target

The properties shown are a fact about registration. They are not a statement that anything can be enforced against, because that depends on charges and liens that the report does not verify.

What this check is not

It is not a general personal investigation or a character reference. It does not replace a lawyer's advice on the structure of a guarantee or a notary's on a deed, and it does not tell you whether to sign. Keep it proportionate: run it before you commit, store the result for as long as the purpose lasts, and do not reuse it for another purpose. For the company side of the same deal, see Checking an Italian company.

Frequently asked questions

Can a UK company check an Italian individual under UK GDPR?

Yes, if it has a lawful basis, usually legitimate interests under Article 6(1)(f), and a specific purpose such as a guarantee, a partner in a deal or a contract with a sole trader. The ICO's three-part test asks about purpose, necessity and balance.

Do I have to tell the Italian individual that I checked them?

Article 14 of the UK GDPR requires certain information to be given when data was not obtained from the person, with exceptions in Article 14(5), for instance where providing it would involve disproportionate effort. Mentioning the check in your contract documents avoids most doubt.

What is the difference between the two Veryfy person reports?

Person Verification (€29) shows protests, adverse records and insolvency proceedings. Extended Person Verification (€49) adds positions in other companies, shareholdings and properties in the person's name.

Can I use the report to check an ex-partner or a neighbour out of curiosity?

No. Veryfy offers the person checks only for declared professional, guarantee or corporate purposes, and excludes personal curiosity, private disputes and monitoring.

Sources

Official sources opened and read on 2026-10-26.

• legislation.gov.uk: UK GDPR, Article 6 (lawfulness of processing)
• legislation.gov.uk: UK GDPR, Article 14 (information where data not obtained from the person)
• legislation.gov.uk: UK GDPR, Article 5 (data minimisation)
• ICO: what is the legitimate interests basis?
• Registro Imprese: protests (contents and retention)

General information, not legal advice. Sources verified on 2026-10-26.