iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Italy’s data protection authority fined IQVIA Solutions Italy €7 million—not $7.8 million—over a health-data database covering one million patients of 800 general practitioners. The Garante found that the records were not anonymous and that IQVIA breached multiple GDPR requirements. Its enforcement order is dated 23 September 2026; the authority announced it on 2 October 2026.
Why did Italy fine IQVIA?
The Italian Data Protection Authority, known as the Garante, said IQVIA Solutions Italy had assembled health information about one million patients of 800 general practitioners. The database supported studies commissioned in part by pharmaceutical companies. The authority’s investigation followed inspections in April 2025 and was combined with a proceeding concerning a personal-data breach that IQVIA had notified.
The Garante treated IQVIA as the controller from the point when data were collected at doctors’ offices. It found that the company processed health data without an appropriate legal basis and did not give patients adequate information. It also identified undefined retention periods, data-security deficiencies, shortcomings in the impact assessment and processor arrangements, and failures involving accountability and privacy by design. The order lists violations of GDPR Articles 5, 9, 13, 25, 28, 32 and 35.
Recommended Free Tools
How much was the IQVIA fine?
The operative penalty is €7 million, as stated in the Garante’s 2 October 2026 press release and enforcement order no. 710, dated 23 September 2026. The $7.8 million figure in the original headline is not the amount ordered by the authority; the official materials state the fine in euros, and do not establish a dollar conversion.
#1 Best Overall
In setting the penalty, the Garante cited the number of patients involved, the sensitive nature of health information and the seriousness of the violations. It also treated the cessation of doctors’ data submissions from 2023 and IQVIA’s cooperation during the proceeding as mitigating factors. The order discusses the GDPR’s maximum-penalty framework, but that statutory maximum is distinct from the €7 million penalty actually imposed.
Were the patient records really anonymous?
No. IQVIA maintained that the data were anonymous, but the Garante concluded that patients could still be singled out and reasonably re-identified. Each patient had a code that allowed the person’s records to be followed over time. The database also contained detailed attributes—including year of birth, sex, diagnoses, symptoms, prescriptions, tests, vaccinations and location information—that could help distinguish individuals.
This is a case-specific finding, not a rule that every coded health dataset is identifiable. The authority’s conclusion turned on the combination of a persistent code, detailed clinical and location data, and means reasonably available to identify people. Replacing direct names with codes does not, by itself, make data anonymous if individuals can still be singled out or re-identified.
What data did IQVIA collect from family doctors?
The database included health information dating back to 2001. The authority’s press release says that direct identifiers—names, tax codes, addresses and contact details—were present for more than 3,300 patients. The decision gives a more precise account: about 3,370 directly identifying patient records were communicated to the Italian Society of General Medicine (SIMG), including health data for 3,080 patients. These figures describe related but distinct counts and should not be treated as interchangeable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the Garante’s order require IQVIA to do?
IQVIA must conform its processing to the authority’s prescriptions and provide a documented response within 120 days of notification of the order. The deadline runs from notification, not from the order’s 23 September 2026 date; the public materials do not provide the notification date needed to calculate a calendar deadline.
The Garante describes two paths: if IQVIA intends to continue the activity, it must bring the processing into compliance; otherwise, doctors must carry out anonymization themselves, subject to the safeguards set by the authority. The decision must also be published. It says judicial opposition may be filed within 30 days of communication, or within 60 days for a claimant residing abroad. The available official materials do not establish whether IQVIA later complied, appealed or took another step.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
