IQVIA Fined €7 Million Under GDPR Over “Anonymous” Patient Data

Calling data “anonymous” does not make it anonymous. A health data company in Italy has just learned that lesson at a cost of €7 million.

On 2 October 2026, Italy’s data protection authority, the Garante, announced a €7 million fine against IQVIA Solutions Italy. The company had built a database with health information on about one million patients. It argued the data was anonymous. The regulator disagreed.

For anyone who handles patient data, from health apps to medical device makers, this case is a clear warning about where the line between anonymous and personal data really sits.

What Happened

IQVIA Solutions Italy is part of a multinational group that works in health data analysis and clinical research. It collected data from the records of around 800 general practitioners (GPs) across Italy. The database was used for studies, some of them commissioned by pharmaceutical companies.

The records covered about one million patients. They included year of birth, sex, diagnoses, symptoms, prescriptions, tests, vaccinations and location data. Some records went back to 2001.

The Garante began inspections in April 2025. A personal data breach that IQVIA itself reported was later added to the case. The regulator adopted its decision (no. 710) on 23 September 2026.

IQVIA has said it cooperated with the regulator, has already taken the necessary measures, and reserves the right to appeal.

Why the “Anonymous” Data Was Still Personal Data

IQVIA did not store patient names in the main dataset. Each patient had a code instead. The company argued this, along with other safeguards, made the data anonymous.

The Garante looked at how the code was used. Each patient kept the same code over time, so their records could be followed for years. Combined with details like birth year, sex, diagnoses and location, this made it possible to single out individuals and re-identify them “by reasonable means”.

In its decision, the regulator put it simply: “pseudonymisation is not a method of anonymisation”.

This matters because truly anonymous data falls outside GDPR. Pseudonymised data does not. If people can still be identified with reasonable effort, every GDPR rule applies, including the stricter rules for health data.

The Garante also treated IQVIA as the data controller from the moment data was collected at the GPs’ offices. The company helped design how the data was exported and processed, so it could not claim it simply received anonymous data from someone else.t.

What Else Went Wrong, and the Lessons

Once the data counted as personal data, other gaps followed. The Garante found that IQVIA:

The regulator gave IQVIA 120 days to bring its processing into line if it wants to continue. Otherwise, the doctors themselves must anonymise the data before sharing it, under safeguards set by the Garante.

In setting the fine, the Garante considered the number of patients, the nature of the data, the fact that doctors stopped sending data in 2023, and the company’s cooperation.

What This Means for Non-EU Health-Tech and Medical Device Companies

IQVIA’s Italian business is based in the EU. Companies based outside the EU face the same rules, plus one more.

Under Article 27 of GDPR, a company outside the EU that offers goods or services to people in the EU, or monitors their behaviour, must appoint a representative in the EU. The UK GDPR has the same rule for the UK. There is a narrow exemption for occasional, low-risk processing, but it does not cover large-scale processing of health data.

That means many health apps, telehealth platforms, wearable makers and connected medical device companies need a representative if they serve EU patients but have no office in the EU. Your representative is the contact point for regulators and for patients who want to use their data rights. They also help keep your records of processing ready to show on request.

Appoint Your GDPR Representative in the EU and UK

Avoid fines and stay compliant with Article 27.
Specialist GDPR Representative services help organisations meet local contact requirements and maintain audit-ready compliance.

Appoint Now

The Takeaway

The IQVIA case shows that regulators look at what data can do, not what a company calls it. If people can be traced over time, the data is personal, and every GDPR duty applies.

For health-tech and medical device companies, now is a good time to check three things: whether your “anonymous” data really is anonymous, whether you have a DPIA and retention plan in place, and, if you are based outside the EU or UK, whether you have appointed a representative.

Ready to Appoint Your GDPR Representative?

Euverify helps global businesses stay compliant with full EU & UK representation.

Get Started