IQVIA Holdings Inc.

Italy's Garante per la protezione dei dati personali issued Decision No. 710 on September 23, 2026, fining IQVIA Solutions Italy €7 million for unlawfully processing health data on roughly 1 million patients collected from about 800 general practitioners. IQVIA treated the data as anonymous, but the Garante found it was only pseudonymized: a persistent patient code was retained for years alongside diagnoses and prescriptions, making individuals re-identifiable. The company obtained no patient consent and had no valid legal basis for the processing (its contract with doctors could not serve as one, since patients were not party to it); no data protection impact assessment was conducted and data was retained with no defined limits, in some cases since 2001. The database also contained direct identifiers (names, tax codes, addresses, contact details) for about 3,370 patients, with health data exposed for roughly 3,080 of them. IQVIA has 120 days to establish a valid legal basis and comply with GDPR transparency obligations, or shift anonymization responsibility to the doctors themselves.