GDPR Enforcement in Life Science & Healthcare

• The biggest healthcare case in 2025 (ETid-2561) originated in the United Kingdom with a fine of EUR 3.5 million. A ransomware attack in August 2022 allowed hackers to access systems of a health subsidiary via a customer account that lacked multi-factor authentication. As a result, the personal data of 79,404 individuals were put at risk. During its investigation, the UK Information Commissioner (ICO) found that the controller failed to implement appropriate technical and organisational measures to protect personal data.
   
• The UK Information Commissioner (ICO) was also responsible for the second-highest fine amounting to EUR 2.7 million (ETid-2656). Although the case was similar to the largest case and also involved a cyberattack due to insufficient technical and organisational measures, it additionally provides interesting insights into five factors that influence the severity of the fine. The cyberattack exposed highly sensitive personal data on DNA information from more than 150,000 individuals over the course of at least five months. In addition, the controller's failure to identify the attack earlier and its failure to adequately inform the DPA about the breach  were aggravating factors.
   
• Regarding TOM fines, the highly active Italian DPA focused on the use of software in healthcare facilities. A common problem in 2025 was software that allowed medical personnel to access more patient data than necessary for treatment (https://www.enforcementtracker.com/ETid-2888 and https://www.enforcementtracker.com/ETid-2889). This problem isn’t new. It has been a focus of the Italian DPA for years. In 2020, an Italian hospital was fined for granting unauthorised staff access to health data (ETid-212). In 2024, a university hospital was fined for the same reason  (ETid-2370).
   
• Another significant reason for high GDPR fines remains non-compliance with general data processing principles. In a Spanish case resulting in a fine of EUR 1.2 million (ETid-3013), a hospital performed MRI scans and allowed patients to bring copies or originals of previous scans. The hospital then deleted the data immediately or after a very short amount of time, meaning that data subjects were unable to easily retrieve their data if they had brought them on physical data carriers. In a Finnish case resulting in a fine of EUR 1.1 million (ETid-2647), an online pharmacy used website tools that allowed the providers, who are based outside the EU, to access personal data without complying with the principle of data minimisation.
   
• Negligence by healthcare facilities resulted in a high number of fines, especially in Romania. In one case (ETid-2546), the controller mistakenly sent a patient's health data via unsecured email to another patient. In another case (ETid-2685), the controller publicly exposed the access credentials for a data subject's email account on a workstation.

• Hotspot 1: Data leaks due to ransomware attacks and other cyberattacks
   
• Hotspot 2: Data leaks due to internal factors like insufficient role and access concepts, inappropriate software use or negligence
   
• Hotspot 3: Not following general data processing principles as fundamental GDPR requirements

For 2026, the European Data Protection Board (EDPB) has selected "compliance with transparency and information obligations" as the topic for its coordinated enforcement action. National authorities can therefore be expected to focus on reviewing and assessing privacy notices, consent forms and other information provided to patients and other data subjects. Data subject information should in any case be reviewed and updated regularly to ensure factual accuracy in compliance with the latest regulatory requirements. With the upcoming coordinated enforcement action in sight, now is a good time to review processes and update documentation where necessary.

Based on the enforcement trends observed in 2025 and previous years, the other above-mentioned topics are likely to remain on DPAs' agendas in the healthcare sector. DPAs will almost certainly continue to scrutinise the cybersecurity posture of healthcare organisations with increasing rigour. In particular, the use of clinical software systems and electronic health records will likely remain a focus, especially for the Italian DPA.

Even though there have not been any AI-related fines in the healthcare sector in 2025, AI-related fines were issued in other sectors such as media, telecoms and broadcasting. As AI-driven tools increasingly enter clinical workflows — from diagnostic support to patient triage — compliance with data protection obligations and with the requirements of the EU AI Act will become a priority for healthcare providers’ efforts and the DPAs’ enforcement activities.