Event Intelligence
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data
Cyber attackBreaking Updated 9th October 2026 · 10:59
- Significance
- Material
- Impact
- Strongly Negative
- Confidence Confidence indicates how reliable ProcIntel considers the event assessment based on the quality, quantity and independence of the supporting evidence. It does not measure the event's importance.
- High
- Evidence
- 1 source 1 signal
Overview
What happened Source facts
Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment) Decision: Administrative fine Key words: Data protection impact assessment, Health and research, Anonymisation/pseudonymisation, Privacy by design and by default, Fines, Basic principles and Controller/processor Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) carried out an investigation into IQVIA Solutions Italy S.r.l., a company belonging to a multinational group active in health data analytics and clinical research. The investigation concerned a database containing health information relating to approximately one million patients of 800 general practitioners, used for studies commissioned also by pharmaceutical companies. The investigation, which followed inspections carried out in April 2025, was joined with proceedings concerning a personal data breach notified by IQVIA. Key Findings The Italian DPA found that the data were not anonymous, as claimed by IQVIA. A persistent identifier assigned to each patient allowed individuals to be tracked over time and, combined with detailed information including year of birth, sex, diagnoses, symptoms, prescriptions, examinations, vaccinations and location data, made it possible to single out and potentially re-identify patients using reasonably available means. The Italian DPA found that IQVIA, as controller, processed health data without an appropriate legal basis and without providing adequate information to patients. It also failed to establish appropriate retention periods, carry out a data protection impact assessment and implement adequate security measures. The database also contained directly identifying information relating to approximately 3 370 patients, including health data for approximately 3 080 of them. Decision The Italian DPA imposed an administrative fine of EUR 7 000 000 on IQVIA Solutions Italy S.r.l. If IQVIA intends to continue the processing, it must bring it into compliance with the GDPR within 120 days, including by identifying an appropriate legal basis, complying with its information obligations towards patients, carrying out a data protection impact assessment and appointing the general practitioners as processors. Alternatively, the anonymisation process must be carried out independently by the general practitioners in accordance with the safeguards specified by the Italian Authority. In determining the amount of the fine, the Italian DPA took into account, among other factors, the large number of data subjects involved, the sensitive nature of the data, as well as mitigating factors including the suspension of data transfers by general practitioners and IQVIA’s cooperation during the proceedings. For further information: COMUNICATO STAMPA - Dati sanitari: 7 milioni di euro di sanzione
Suggested considerations
Derived from this Event's rating and type — prompts for your team to evaluate, not reported facts and not recommendations.
- Monitor for explicit timing evidence.
- Determine whether internal exposure warrants earlier investigation.
Date evidence from the source: “The investigation, which followed inspections carried out in April 2025, was joined with proceedings concerning a personal data breach notified by IQVIA.</p><h3>Key Findings</h3><p>The Italian DPA found that the data were not anonymous, as claimed by IQVIA.”
Suggested Considerations
These are prompts for a procurement team to evaluate, generated from this Event's rating and type. They are not reported facts and not instructions — ProcIntel does not know your contracts, suppliers or exposure.
- Monitor for explicit timing evidence.
- Determine whether internal exposure warrants earlier investigation.
How to read this Event
- Source facts what the original source reported.
- ProcIntel assessment ProcIntel's own interpretation of those facts.
- Consideration a suggested question for your team — never a recommendation to act.
Source Facts
Only what the sources reported. Nothing on this page is ProcIntel's interpretation.
Recorded source facts
Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment) Decision: Administrative fine Key words: Data protection impact assessment, Health and research, Anonymisation/pseudonymisation, Privacy by design and by default, Fines, Basic principles and Controller/processor Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) carried out an investigation into IQVIA Solutions Italy S.r.l., a company belonging to a multinational group active in health data analytics and clinical research. The investigation concerned a database containing health information relating to approximately one million patients of 800 general practitioners, used for studies commissioned also by pharmaceutical companies. The investigation, which followed inspections carried out in April 2025, was joined with proceedings concerning a personal data breach notified by IQVIA. Key Findings The Italian DPA found that the data were not anonymous, as claimed by IQVIA. A persistent identifier assigned to each patient allowed individuals to be tracked over time and, combined with detailed information including year of birth, sex, diagnoses, symptoms, prescriptions, examinations, vaccinations and location data, made it possible to single out and potentially re-identify patients using reasonably available means. The Italian DPA found that IQVIA, as controller, processed health data without an appropriate legal basis and without providing adequate information to patients. It also failed to establish appropriate retention periods, carry out a data protection impact assessment and implement adequate security measures. The database also contained directly identifying information relating to approximately 3 370 patients, including health data for approximately 3 080 of them. Decision The Italian DPA imposed an administrative fine of EUR 7 000 000 on IQVIA Solutions Italy S.r.l. If IQVIA intends to continue the processing, it must bring it into compliance with the GDPR within 120 days, including by identifying an appropriate legal basis, complying with its information obligations towards patients, carrying out a data protection impact assessment and appointing the general practitioners as processors. Alternatively, the anonymisation process must be carried out independently by the general practitioners in accordance with the safeguards specified by the Italian Authority. In determining the amount of the fine, the Italian DPA took into account, among other factors, the large number of data subjects involved, the sensitive nature of the data, as well as mitigating factors including the suspension of data transfers by general practitioners and IQVIA’s cooperation during the proceedings. For further information: COMUNICATO STAMPA - Dati sanitari: 7 milioni di euro di sanzione
This Event rests on a single report. It has not been corroborated by a second, independent source.
-
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data
Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment) Decision: Administrative fine Key words: Data protection impact assessment, Health and research…
Open original report → edpb.europa.eu
Linked Signals
Every collected Signal that contributed to this Event, with how it was matched.
| Published | Headline | Source | Matched text | Extraction confidence | Method |
|---|---|---|---|---|---|
| 9th October 2026 | Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data | EDPB News RSS | data breach | 95.0 | high precision phrase |
Why ProcIntel Rates This
Every rating below is produced from the logged facts by consistent, rules-based scoring — never from the tone or wording of the source.
Significance Significance estimates the potential procurement impact of the event, including factors such as supply, cost, operations, geography and strategic importance.
3 · Material- This type of disruption typically has a moderate procurement impact.
- No specific geography identified yet.
- No specific organisation linked yet — geographies, commodities and routes do not count as organisations.
- No procurement category has been determined for this event.
- Time horizon is not yet assessed for individual Events; a standard short-term assumption is used.
Confidence Confidence indicates how reliable ProcIntel considers the event assessment based on the quality, quantity and independence of the supporting evidence. It does not measure the event's importance.
4 · High- Reported by at least one primary/official source.
- Reported by a single source so far — not yet independently corroborated.
- Key facts (what happened, when) are fully documented.
- Evidence was last updated within the last month.
Urgency How soon the evidence already identified for this event suggests action may be needed. Unknown means no sufficiently explicit or quantified timing evidence has been identified -- ProcIntel never infers a timeframe where the evidence does not support one.
UnknownTiming not established. No sufficiently explicit or quantified timing evidence has been identified. Procintel has not inferred urgency where timing evidence is insufficient.
Impact Direction Whether the procurement impact of this development is assessed as negative, positive, or neutral/mixed.
Strongly NegativeProvisional default — not yet reviewed.