Liability

Legal Framework

Article 82 GDPR is the governing provision for compensation and liability allocation. Under Article 82(1), any person who has suffered material or non-material damage as a result of a GDPR infringement may claim compensation from the controller or processor responsible.

"Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."
— GDPR Art. 82(1)

The liability regime draws a critical distinction between controllers and processors. Article 82(2) makes a controller liable for damage caused by any infringing processing, whereas a processor's liability is narrower—attaching only where it failed to comply with processor-specific obligations or acted outside or contrary to lawful instructions. Both controllers and processors may invoke the exemption under Article 82(3), which shifts the burden of proof to the defendant:

"A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage."
— GDPR Art. 82(3)

Where multiple parties participate in the same processing, Article 82(4) imposes liability for the entire damage on each responsible party, with a corresponding right of recourse under Article 82(5) based on respective shares of responsibility.

Key Developments

Enforcement decisions confirm that inadequate technical and organisational measures directly generate liability exposure. In the Permanent TSB enforcement action, the Irish DPA linked organisational failures to concrete vulnerability of data subjects, reinforcing that supervisory authorities treat the severity and likelihood of harm as key parameters when assessing consequences of infringement.

"A breach can potentially have a range of significant adverse effects on individuals, which can result in physical, material, or non-material damage."
— EDPB Guidelines 9/2022 §24

National DPAs have imposed substantial fines where controllers failed to prevent such damage: the Lithuanian DPA fined two medical companies €450,000 following data breaches involving unauthorised access to internal systems, while the Croatian DPA fined a gas station operator €940,000. These decisions signal that both the number of affected individuals and the level of damage suffered inform supervisory assessment of liability consequences.

Status of the Debate

This topic is contested in court. While Article 82 provides a structured liability framework, member state courts diverge on key thresholds—particularly the standard for proving causation between an infringement and actual damage, and the precise scope of the Article 82(3) exemption. The CJEU has addressed adjacent questions in Mousse (C-394/23) regarding legitimate interests and risk to data subjects, but has not yet ruled definitively on the boundaries of the Article 82 liability regime. No court split has been formally resolved through a preliminary reference on the meaning of "not in any way responsible" or on whether non-material damage requires concrete manifestation. A CJEU reference on those questions would settle the most pressing open issues.

Practical Guidance

• Document accountability for each processing operation: Controllers bear broader liability under Article 82(2) than processors; maintain records demonstrating lawfulness and adequacy of measures to support a potential Article 82(3) exemption defence.
• Allocate liability precisely in processor contracts: Under Article 82(5), a party paying full compensation may reclaim from co-responsible parties; contracts should pre-define responsibility shares to streamline recourse claims.
• Maintain evidence of compliance for the Article 82(3) exemption: The burden of proving non-responsibility rests on the controller or processor; risk assessments, security audit logs, and incident response records are essential to discharge that burden.
• Assess damage severity proactively following breaches: EDPB guidelines and national enforcement confirm that both the number of affected individuals and the level of damage suffered inform supervisory action; breach impact assessments should document both dimensions.
• Prepare for joint liability scenarios: Where multiple controllers or processors share a processing activity, Article 82(4) makes each liable for the entire damage; contractual indemnities should reflect this exposure.