Garante per la protezione dei dati personali (Italy) - 710/2026
Italy's Garante fines IQVIA €7M for GDPR violations after patient data breach.
Run IQVIA?
Get an email when a reviewed story names IQVIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Italy's Garante per la protezione dei dati personali has issued a €7,000,000 fine to IQVIA Solutions Italy S.r.l. following a data breach that exposed the personal information of 3,780 patients. The investigation revealed unlawful processing due to a lack of understanding of GDPR obligations, inadequate data protection by design, and the absence of a Data Protection Impact Assessment (DPIA).
The lesson from this incident
Full lessonIQVIA Solutions Italy faced a €7,000,000 fine after a breach exposed the personal data of 3,780 patients, stemming from a fundamental misunderstanding of GDPR obligations and a failure to embed data protection into its processes from the outset. The absence of a Data Protection Impact Assessment (DPIA) — a legally required safeguard for high-risk processing activities — meant that risks to patient data were never formally identified or mitigated. Inadequate data protection by design indicates that privacy considerations were treated as an afterthought rather than a core architectural principle. This case illustrates that regulatory non-compliance is not merely a paperwork issue; it directly enables real harm to real individuals and exposes organisations to severe financial and reputational consequences.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.