Francesco di Castri’s personal method
Legal and regulatory context
Context, constraints and coordination with specialist expertise.
Decisions on risk, protection and crises must take account of the rules applicable to the context. These references inform discussion with the functions and specialists involved; they are not a list of obligations valid for every organisation.
Public security and private guarding
TULPS, Royal Decree no. 773 of 18 June 1931, and its implementing regulation, Royal Decree no. 635 of 6 May 1940, define the framework for public security and activities subject to authorisation. Coordinating protection requires a distinction between organisational roles, the powers of authorities and activities reserved to authorised parties.
When a project involves private guarding firms, Ministerial Decree no. 269 of 1 December 2010 provides a reference for organisational requirements and service quality. This concerns the context and providers involved: it does not attribute a guarding or investigation licence to Strathego.
TULPS on Normattiva · TULPS implementing regulation on Normattiva · Ministerial Decree 269/2010 on Normattiva
Governance and corporate liability
Legislative Decree no. 231 of 8 June 2001 governs the liability of entities for offences arising from crimes, within its scope of application. It is relevant to the connection between risks, responsibilities and organisational controls. Discussion of an organisational, management and control model, where present or relevant, requires the competent functions and specialists.
Strathego’s contribution remains within the agreed scope of analysis and coordination: it is not a legal opinion, an appointment to a Supervisory Body or a guarantee of exemption from liability.
Occupational health, safety and emergencies
Legislative Decree no. 81 of 9 April 2008 concerns occupational health and safety. It provides a reference for connecting security, safety, emergency management and preparation of people, according to actual activities and risks.
Organisational coordination does not replace risk assessment, employer obligations, the prevention and protection service or other statutory roles. Strathego programmes are not presented as mandatory or qualifying training under the decree.
Personal data and protection measures
The GDPR, Regulation (EU) 2016/679, is relevant when activities involve processing personal data: for example access control, video surveillance or information management during a crisis. Purposes, legal basis, proportionality, retention periods and processing security must be assessed in the specific context.
Organisational choices must be coordinated with the controller, privacy functions and the DPO, where appointed. Strathego support does not constitute certification of GDPR compliance.
Artificial intelligence: use, limits and skills
The AI Act, Regulation (EU) 2024/1689, is relevant when artificial intelligence systems are used. Discussion concerns intended use, the organisation’s role, risks to people, AI literacy and, for systems subject to such requirements, human oversight.
Applicability, prohibitions, requirements and effective dates must be checked for the specific system and use against the current version. Not every system used in security is automatically high-risk. Organisational and training support does not certify a system or declare its compliance.
Coordination with cybersecurity for entities in scope
The NIS2 Directive, transposed by Legislative Decree no. 138 of 4 September 2024, concerns entities identified by the rules and their cybersecurity risk management and incident notification obligations. It does not apply indiscriminately to all businesses.
Where relevant to the project, it provides a reference for connecting governance and crisis management with cybersecurity functions. The reference does not introduce an offer of technical cyber services or replace the responsibilities of obligated entities.
Scope and sources
Strathego is Francesco di Castri’s personal consulting method. These references do not qualify Strathego as a law firm, certification body or private guarding firm. Reserved activities, specialist reviews and responsibilities remain with the competent parties.
Local reference text dated 9 October 2026. On 22 October the references and official Normattiva records were rechecked; EUR-Lex required JavaScript verification and did not return the GDPR and AI Act texts. No complete legal review or verification of every provision’s current force is claimed. Applicability and effective dates must be checked for the specific assignment.
The Strathego Method ↗