What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Italy’s data protection authority fined IQVIA Solutions Italy €7 million—not $7.8 million—over a database containing health information about one million patients treated by 800 general practitioners. The Garante said the records were not anonymous and found violations of several GDPR requirements.
Why did Italy fine IQVIA?
The Italian Data Protection Authority, known as the Garante, said IQVIA Solutions Italy assembled and used a database of health information for studies commissioned in part by pharmaceutical companies. Its investigation followed inspections in April 2025 and was joined to a proceeding concerning a personal-data breach that IQVIA had notified.
As an Amazon Associate I earn from qualifying purchases.
The Garante treated IQVIA as the data controller from the point at which information was collected at doctors’ offices. It found that the company processed health data without an appropriate legal basis and without giving patients adequate information. The authority also identified problems with retention, security, impact assessment, processor arrangements, accountability and privacy by design. The order cites violations of GDPR Articles 5, 9, 13, 25, 28, 32 and 35. The Garante’s 2 October 2026 announcement and enforcement order no. 710, dated 23 September 2026, set out the findings.
Recommended Free Tools
How much was the IQVIA fine?
The penalty ordered was €7 million. The official announcement and order state the amount in euros; the $7.8 million wording in the original title is not the official fine, and the official materials do not provide a dollar conversion.
#1 Best Overall
The Garante cited the number of people affected, the sensitive nature of health information and the seriousness of the violations. It treated doctors’ cessation of data submissions from 2023 and IQVIA’s cooperation during the proceeding as mitigating factors. The order also discusses the GDPR’s maximum-penalty framework, which is distinct from the €7 million penalty actually imposed.
Were the patient records really anonymous?
No, according to the Garante. IQVIA maintained that the data were anonymous, but the authority concluded that patients could be singled out and re-identified using reasonably available means. A code assigned to each patient made it possible to follow that person over time, while the records included detailed attributes such as year of birth, sex, diagnoses, symptoms, prescriptions, tests, vaccinations and location information.
Rank #2
This is a case-specific finding, not a rule that every coded health dataset is identifiable. Here, the combination of a persistent code and detailed attributes led the authority to conclude that the records remained personal data rather than anonymous data.
What data did IQVIA collect from family doctors?
The database covered health information about one million patients of 800 general practitioners. The Garante said the information reached back to 2001, although doctors stopped sending data from 2023.
The authority also found direct identifiers in the database. Its announcement described more than 3,300 patients as affected; the order gives a more precise figure of about 3,370 directly identifying records communicated to SIMG, including health data for 3,080 patients. These figures describe different levels of precision in the Garante’s public materials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the Garante’s order require IQVIA to do?
IQVIA must bring its processing into line with the authority’s prescriptions and provide a documented response within 120 days of notification of the order. The deadline runs from notification, not from the order’s date of 23 September 2026, so the public materials do not establish a calendar due date.
The Garante’s announcement describes the alternatives: if IQVIA intends to continue the activity, it must make the processing compliant; otherwise, doctors must anonymize the data themselves subject to safeguards set by the authority. The order also directs publication of the decision. It says judicial opposition may be filed within 30 days of communication, or within 60 days if the claimant resides abroad.
The public sources cited here do not establish whether IQVIA later complied, appealed or otherwise acted on the decision.
Quick Recap
Best Value
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
