Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data
Italian DPA fines IQVIA EUR 7M for unlawful processing of patient health data.
The Italian Data Protection Authority (DPA) has fined IQVIA Solutions Italy S.r.l. EUR 7 million for unlawfully processing the health data of approximately one million patients. The DPA found that the data, used for health analytics and clinical research, was not adequately anonymized and IQVIA failed to establish a proper legal basis, provide sufficient information to patients, and implement adequate security measures. IQVIA has 120 days to comply with GDPR requirements or anonymize the data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IQVIA?
Get an email when a new story names IQVIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIQVIA unlawfully processed the sensitive health data of approximately one million patients by failing to properly anonymize it and lacking a valid legal basis under GDPR. The case highlights that pseudonymization or partial de-identification does not satisfy GDPR anonymization requirements, meaning the data remained regulated personal data throughout its use in analytics and research. Organizations handling health data must establish a clear lawful basis, provide transparent patient notices, and implement robust technical safeguards before any processing begins. This incident demonstrates that regulatory fines can be severe when multiple GDPR obligations—legal basis, transparency, and security—are violated simultaneously.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.