# IQVIA Solutions Italy S.r.l.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Italian Data Protection Authority (Garante)
- Date: 2026-09-23
- Original: https://www.enforcementtracker.com/ETid-3356
- Canonical: https://overview.legal/posts/603871
- Topics: Supervisory Authorities

## Summary

The Italian Data Protection Authority (Garante) fined IQVIA Solutions Italy S.r.l. €7,000,000 for processing personal data without a sufficient legal basis, involving violations of multiple GDPR articles concerning principles of lawfulness, fairness, transparency, and special category data protections. The enforcement action targeted the healthcare sector company's failure to establish valid legal grounds for processing, alongside related deficiencies in information notices, data protection by design, controller-processor arrangements, security measures, and data protection impact assessments.

## Full text

Italian Data Protection Authority (Garante) fined IQVIA Solutions Italy S.r.l. €7,000,000 on 2026-09-23 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a), e), f) GDPR, Art. 5 (2) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 (1) b), d) GDPR, Art. 35 GDPR
Sector: Health Care
Country: Italy
Source: https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10302112

---
Generated by overview.legal · https://overview.legal/posts/603871 · 2026-10-24