Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data

<div class="heading-wrapper"><h2 id="background-information">Background information</h2><ul><li>Date of final decision: 23 September 2026</li><li>National case</li><li>Controller: IQVIA Solutions Italy S.r.l</li><li>Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), &nbsp;Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment)</li><li>Decision: Administrative fine</li><li>Key words: Data protection impact assessment, Health and research, Anonymisation/pseudonymisation, Privacy by design and by default, Fines, Basic principles and Controller/processor</li></ul></div><div class="heading-wrapper"><h2 id="summary-of-the-decision">Summary of the Decision</h2><h3>Origin of the case</h3><p>The Italian Data Protection Authority (DPA) carried out an investigation into IQVIA Solutions Italy S.r.l., a company belonging to a multinational group active in health data analytics and clinical research. The investigation concerned a database containing health information relating to approximately one million patients of 800 general practitioners, used for studies commissioned also by pharmaceutical companies. The investigation, which followed inspections carried out in April 2025, was joined with proceedings concerning a personal data breach notified by IQVIA.</p><h3>Key Findings</h3><p>The Italian DPA found that the data were not anonymous, as claimed by IQVIA. A persistent identifier assigned to each patient allowed individuals to be tracked over time and, combined with detailed information including year of birth, sex, diagnoses, symptoms, prescriptions, examinations, vaccinations and location data, made it possible to single out and potentially re-identify patients using reasonably available means.</p><p>The Italian DPA found that IQVIA, as controller, processed health data without an appropriate legal basis and without providing adequate information to patients. It also failed to establish appropriate retention periods, carry out a data protection impact assessment and implement adequate security measures. The database also contained directly identifying information relating to approximately 3 370 patients, including health data for approximately 3 080 of them.</p><h3>Decision</h3><p>The Italian DPA imposed an administrative fine of EUR 7 000 000 on IQVIA Solutions Italy S.r.l.</p><p>If IQVIA intends to continue the processing, it must bring it into compliance with the GDPR within 120 days, including by identifying an appropriate legal basis, complying with its information obligations towards patients, carrying out a data protection impact assessment and appointing the general practitioners as processors. Alternatively, the anonymisation process must be carried out independently by the general practitioners in accordance with the safeguards specified by the Italian Authority.</p><p>In determining the amount of the fine, the Italian DPA took into account, among other factors, the large number of data subjects involved, the sensitive nature of the data, as well as mitigating factors including the suspension of data transfers by general practitioners and IQVIA’s cooperation during the proceedings.</p><p><strong>For further information:</strong>&nbsp;</p><ul><li><a href="https://gpdp.it/home/docweb/-/docweb-display/docweb/10302141">COMUNICATO STAMPA - Dati sanitari: 7 milioni di euro di sanzione</a></li></ul></div>

Publication

EDPB News RSS · Government/Regulator

Published

9th October 2026

Original report

edpb.europa.eu

ProcIntel stores what the source published in its feed — a headline, a summary and a link. It does not store or reproduce the full article.