Article 4 GDPR: Key Legal Definitions

Personal Data and Processing (Art. 4.1 & 4.2)

Article 4(1) defines personal data as ‘any information relating to an identified or identifiable natural person’. Identification may occur directly by name or indirectly via an online identifier (dynamic IP address, cookie identifier — CJEU Case C-582/14 Breyer).

Article 4(2) confers an exceptionally broad scope upon processing, covering any operation or set of operations performed on personal data (collection, recording, storage, alteration, retrieval, consultation, dissemination, erasure or destruction).

Controller vs Processor (Art. 4.7 & 4.8)

The legal qualification of actors is functional and follows EDPB Guidelines 07/2020:

• Data controller (Art. 4.7): The natural or legal person which, alone or jointly with others, determines the purposes (‘why’) and essential means (‘how’) of the processing;
• Data processor (Art. 4.8): The entity which processes personal data on behalf of the controller and strictly in accordance with documented instructions;
• Recipient (Art. 4.9) and Third party (Art. 4.10): Natural or legal persons to whom personal data are disclosed.

IQVIA — Supervisory authority decision — Italy (23 September 2026)

In the IQVIA case, the Garante found that longitudinal codes combined with detailed clinical and location data enabled patients to be singled out and reidentified by reasonable means (§§ 82–101). Removing names did not establish anonymity in this context.

For IQVIA's LPD database, the safeguards did not eliminate identifiability (§§ 82–101). Pseudonymisation reduces risk but does not, by itself, establish anonymisation, which requires assessing the means reasonably likely to be used in the specific context. Anonymising personal data is itself processing subject to the GDPR.

The Garante treats IQVIA as controller from collection because it determined the purposes and means of the LPD project (§§ 68–81). Doctors remain controllers for patient care; for project operations performed on behalf of IQVIA, the authority requires processor appointments if that activity continues (§ 144). Roles depend on the facts and each processing operation.

• Findings concern the database and operations examined; qualification must be assessed for each processing operation.

Decision no. 710, subject to judicial challenge; no filed appeal confirmed in the official sources consulted as of 11 October 2026.

Verified Official Sources

See Also in the Legal Framework