Garante per la protezione dei dati personali (Italy) - 710/2026
Italy's DPA fines IQVIA €7M for GDPR violations after patient data breach.
Run IQVIA?
Get an email when a reviewed story names IQVIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Italy's Garante per la protezione dei dati personali (DPA) has issued a €7 million fine to IQVIA for violations of the GDPR. The fine was imposed after a routine inspection uncovered a data breach that led to the disclosure of 3,780 patients' data, including sensitive health information. The DPA found that IQVIA engaged in unlawful processing operations due to a lack of understanding of GDPR obligations, inadequate data protection by design, and the absence of a Data Protection Impact Assessment (DPIA).
The lesson from this incident
Full lessonIQVIA was fined €7 million after a routine inspection revealed a data breach exposing sensitive health information of 3,780 patients, driven by unlawful data processing, inadequate data protection by design, and the complete absence of a Data Protection Impact Assessment (DPIA). The root cause was a fundamental lack of organisational understanding of GDPR obligations, meaning privacy and security requirements were never properly embedded into data processing workflows. This matters because health data is among the most sensitive categories under GDPR, carrying heightened legal obligations and significantly greater potential for harm to affected individuals. Organisations handling special category data must treat compliance not as a checkbox exercise but as an ongoing operational discipline integrated from the earliest stages of system and process design.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.