Italian DPA Fines IQVIA EUR 7 000 000 Over Patients' Health Data
The Italian Data Protection Authority has fined IQVIA Solutions Italy S.r.l. EUR 7 000 000 for unlawfully processing the health data of patients, after finding that a database the company described as anonymous allowed individuals to be re-identified. The final decision is dated 23 September 2026, according to the European Data Protection Board (EDPB).
- The Italian DPA fined IQVIA Solutions Italy S.r.l. EUR 7 000 000; the final decision is dated 23 September 2026.
- The database covered approximately one million patients of 800 general practitioners and was not anonymous, the authority found.
- IQVIA lacked a legal basis, adequate patient information, retention periods, an impact assessment and adequate security measures.
- IQVIA has 120 days to bring any continued processing into GDPR compliance, or the doctors must carry out anonymisation themselves.
How the case began
The Italian DPA investigated IQVIA Solutions Italy S.r.l., a company that belongs to a multinational group active in health data analytics and clinical research. The inquiry focused on a database containing health information on approximately one million patients of 800 general practitioners. According to the EDPB summary, the database was used for studies commissioned also by pharmaceutical companies.
The investigation followed inspections carried out in April 2025. It was joined with proceedings concerning a personal data breach that IQVIA itself had notified to the authority.
Why the data was not anonymous
IQVIA had claimed the data were anonymous. The Italian DPA disagreed. It found that a persistent identifier assigned to each patient allowed individuals to be tracked over time. Combined with detailed information, this made it possible to single out and potentially re-identify patients using reasonably available means.
The detailed information included:
- year of birth and sex
- diagnoses and symptoms
- prescriptions, examinations and vaccinations
- location data
The database also contained directly identifying information relating to approximately 3 370 patients, including health data for approximately 3 080 of them.
The violations found
The authority concluded that IQVIA, acting as controller, processed health data without an appropriate legal basis and without giving patients adequate information. It also failed to set appropriate retention periods, to carry out a data protection impact assessment and to put adequate security measures in place.
The legal references listed for the case are Articles 5, 9, 13, 25, 28 and 35 of the GDPR. They cover the basic principles of processing, special categories of personal data, information to data subjects, data protection by design and by default, the role of the processor, and impact assessments.
Fine and corrective measures
Besides the EUR 7 000 000 administrative fine, the authority set conditions for any continuation of the processing. If IQVIA wants to carry on, it must bring the processing into line with the GDPR within 120 days. That includes identifying an appropriate legal basis, meeting its information obligations towards patients, carrying out a data protection impact assessment and appointing the general practitioners as processors.
The alternative is that the anonymisation process is carried out independently by the general practitioners, in accordance with the safeguards specified by the Italian authority.
In setting the amount, the authority weighed the large number of data subjects and the sensitive nature of the data. Mitigating factors were the suspension of data transfers by general practitioners and IQVIA's cooperation during the proceedings.
What it means
The decision shows that a claim of anonymisation will not hold if a persistent identifier and rich clinical and location details make it possible to single out patients. For companies that use health data for research and analytics, the ruling points to the need for a clear legal basis, patient information and an impact assessment, and to a defined role for the doctors who supply the data.
