Contents
Are lockboxes legal?
There is no single national rule that blesses or bans every smart lockbox. Instead, three layers decide what you can do in a given building and street:
City rules. Municipalities regulate what can be installed on public land and visible structures (poles, gates, façades). Several tourist cities have started to prohibit key-boxes in public view to address safety, decorum and nuisance complaints. If your box is on a fence or railings that face the street, you may be asked to remove it—or be fined.
Condominium rules. Most Italian apartment buildings are condominiums. Anything affixed to common parts (facade, entrance hall, gate, mailbox panels) usually requires administrator approval or a vote. Even when allowed, the assembly can restrict placement to preserve safety and decorum. A private lockbox on your exclusive door inside your unit is treated differently than a device drilled into the main gate.
Privacy rules. If your access solution captures or processes personal data (smart locks with logs, doorbell cams that record video/audio), Italy’s data-protection authority expects transparency, minimisation and secure storage. Guests must be informed clearly about what’s collected and why. Recording common spaces without justification—or keeping logs longer than needed—can create liability.
Bottom line: compliance depends on where the device sits, what it does, and how your city and building regulate visibility and access.
Milan’s ban (and beyond)
Milan has explicitly banned key-boxes on public land and visible street fixtures, introducing fines for boxes mounted on poles, fences and gates. Enforcement begins after a short grace period, and non-compliant devices may be removed by the authorities. If you host in Milan and rely on a street-facing key safe, plan to relocate or replace it before enforcement starts. Similar measures have already appeared in other Italian cities, particularly in tourist centres that experienced a surge of boxes clustered on façades.
What does this mean in practice? Hosts should map every access point a guest touches—from the sidewalk to the apartment door—and ensure none of the devices violate city rules or building restrictions. If your current solution is street-visible, consider shifting to options that keep access inside the building envelope or remove hardware from public view entirely.
If you operate in another city, don’t assume nothing will change. Popular destinations often copy each other’s policies; monitoring your municipality’s press releases and council decisions should be part of your hosting routine.
Condominium approvals
Even where the city allows access devices, the condominium may not. As a rule of thumb, anything fixed to common parts (external gate, shared corridor, lobby wall, mailbox panel) requires prior written clearance from the administrator or assembly. Installing first and asking later is risky: neighbours can demand removal and the administrator can levy costs if common property is damaged.
Smart best practice: submit a short memo with a photo of the proposed device, installation spot, and reversible mounting method. Offer to avoid drilling and to place the device where it is not visible from the street. If the building already has a policy for parcel lockers or intercom upgrades, propose a similar approach for guest access. Keep all approvals on file; you may need them if inspectors visit.
Finally, remember that “the least intrusive solution” usually wins. A small device on your own door, or a fully digital solution with no external hardware, will face fewer objections than a metal box bolted to a decorative gate.
Privacy & ID checks
Many access tools do more than hand out keys: they log codes, store names, and sometimes record video or audio. In Italy, that means data-protection duties. You must inform guests clearly about what is collected (e.g., access-log timestamps), why you collect it (security and handover traceability), who can see it (you or your manager), and how long you keep it. Keep retention short and restrict access to those who actually need it.
If your solution includes a camera pointed at common areas, the bar is higher. You must avoid filming more than is strictly necessary, and signage must be visible and comprehensible. Recording audio is rarely defensible for access control and often triggers additional scrutiny. When in doubt, use devices that do not capture images or sound and rely on code-based audit trails instead.
Guest identity is a separate issue: hosts must follow lawful identification procedures required for accommodation. Do not improvise ID collection beyond what the law requires, and avoid storing passport scans in unsecured apps or inboxes. If you use a channel manager or PMS, enable encrypted uploads and role-based access so data is not shared widely within your team.
Safer alternatives
If a street-visible lockbox is off-limits in your city or building, you still have frictionless options that protect guests and keep you compliant:
- Smart locks on the apartment door (inside the building), with timed codes that expire after checkout. Ensure batteries and a physical override key are available in case of failure.
- Concierge or key-exchange desks inside authorized premises, with ID checks and controlled handover. Some operators offer extended hours and multilingual staff.
- On-site meet-and-greet partners for the first access only, then digital codes for re-entry. This satisfies building concerns and helps verify IDs correctly at least once.
- Parcel-style lockers placed in an internal, approved area—not visible from the street—and managed under a building policy that covers liability and maintenance.
Whichever option you choose, document the process and keep a simple playbook for cleaners and co-hosts so everyone follows the same script. Consistency is part of compliance.
Compliance checklist
Before next season, treat access control like any other part of your legal setup—taxes, contracts, and insurance. A one-hour audit can save fines and neighbour disputes later.
- Map devices and visibility. Photograph each lockbox, intercom, keypad and sign from the street and lobby. Anything visible from outside is higher risk in cities that restrict key-boxes.
- Ask the administrator. Request written condominium approval for anything on common parts. Offer non-invasive mounting and a “no street view” location.
- Update guest messaging. Replace old “street box” instructions with approved indoor routes. Add emergency backup steps if a code fails.
- Harden privacy. Turn off audio/video where unnecessary. Shorten log retention. Use unique, time-limited codes per booking rather than one code for all.
- Review ID flows. Ensure identity checks follow the lawful procedure for accommodation and that documents are handled securely (no passport photos in WhatsApp groups).
- Plan for inspections. Keep approvals, device manuals, and a one-page compliance note in a single PDF. If asked, you can show diligence immediately.
- Align taxes & reporting. If hosting moves from hobby to business scale, speak with a professional about the right taxation, registration, and invoicing path.
When to call a commercialista
Changes to access and check-in often coincide with broader upgrades—cleaning teams, channel managers, a tighter calendar. That’s usually the moment your tax picture shifts, too. If you’re deciding between short-term and long-term rentals, compare the tax consequences before you invest in new hardware; start with a practical overview in our guide to short-term vs. long-term rentals in Italy. If you plan to convert a medium-term lease into tourist stays, refresh your contract knowledge with understanding Italian rental agreements, and if your hosting now resembles a business, check whether it’s time to get help: do I really need a commercialista in Italy?
As city rules evolve, having an accountant attuned to local ordinances and building practice is an advantage. They can coordinate with your building administrator and property manager so that access, contracts, and tax treatment move in step—no surprises when the next council decision lands.
What to do this week
Audit where your lockbox or access device sits, get the building’s green light in writing, and retire any street-visible boxes in cities that now restrict them. Document privacy settings and ID flows, train co-hosts on the new process, and update check-in messages before your next booking. With small changes, you can keep the convenience of self-check-in—and stay on the right side of Italian rules.
For official details on Milan’s policy, consult the city’s notice about the ban and fines. For privacy expectations when devices record or process data, refer to the national data-protection authority’s guidance on video-systems and access control in shared buildings.
