Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data

What happened

The Italian Data Protection Authority fined IQVIA Solutions Italy EUR 7 000 000 after finding unlawful processing of health data from roughly one million patients. The investigation, triggered by inspections in April 2025, revealed that the data were not anonymised and lacked a legal basis, proper information, retention periods, DPIA and security measures. IQVIA must remedy the breaches within 120 days or anonymise the data via the general practitioners. The fine considered the scale, sensitivity of data and mitigating cooperation factors.

Why it matters

Any entity handling large volumes of health data in the EU must ensure a valid legal basis, transparent patient notices, retention policies, DPIAs and robust security, or face similar fines.

Business impact

Failure to meet GDPR requirements can result in multi‑million‑euro penalties and operational disruption while remediation must be completed within a tight timeframe.

Checklist

• Identify legal basisCritical priority

  Determine and document a lawful basis for processing each category of health data.

• Update patient informationHigh priority

  Provide clear privacy notices covering the scope and purpose of data processing.

• Conduct DPIAHigh priority

  Perform a data protection impact assessment for the health database and remediate identified risks.

• Define retention periodsMedium priority

  Establish and enforce data retention schedules aligned with GDPR principles.

Who reported it

Discussion