Skip to main content
Praxikon
Agent check

Article 82: Right to compensation and liability

Praxikon tracks Article 82 (Right to compensation and liability) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIIIIn force since 25-05-2018

Official text

/
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.
Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.
Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.
Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 79: Right to an effective judicial remedy against a controller or processor

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (10)

  • 4 September 2025 · C-655/23 · CJEU
    Quirin Privatbank

    Negative feelings such as fear or annoyance are non-material damage if the data subject proves them. The GDPR itself gives no right to an injunction against future breaches, but national law may, without reducing compensation.

  • 8 January 2025 · T-354/22 · General CourtRegulation 2018/1725
    Bindl v Commission

    The General Court orders the Commission to pay 400 euros: a Facebook sign-in link on its website sent an IP address to the US without an appropriate safeguard. Decided under Regulation 2018/1725.

  • 4 October 2024 · C-200/23 · CJEU
    Agentsia po vpisvaniyata

    A commercial register that publishes personal data is a controller, including for data that were not required. A handwritten signature is personal data, and a brief loss of control over data can be non-material damage.

  • 4 October 2024 · C-507/23 · CJEU
    Patērētāju tiesību aizsardzības centrs

    An apology can be sufficient compensation for non-material damage if it fully makes good the damage. The controller's attitude and motives may not reduce compensation.

  • 20 June 2024 · C-182/22, C-189/22 · CJEU
    Scalable Capital

    Compensation is purely compensatory, and damage from a data breach is not by nature less significant than physical injury. Identity theft requires actual misuse of the identity, but compensation is possible without such misuse.

Show 5 more
  • 11 April 2024 · C-741/21 · CJEU
    juris

    An infringement is not in itself non-material damage. The controller cannot escape the duty to compensate by pointing to an employee's error, and the Article 83 fining criteria do not set the amount of compensation.

  • 25 January 2024 · C-687/21 · CJEU
    MediaMarktSaturn

    A document handed to a third party by mistake does not in itself prove that the measures were inadequate. A purely hypothetical risk of misuse is not damage.

  • 21 December 2023 · C-667/21 · CJEU
    Krankenversicherung Nordrhein

    Processing health data under an exception in Article 9(2) also requires a legal basis under Article 6. Compensation has a compensatory, not a punitive, function.

  • 14 December 2023 · C-340/21 · CJEU
    Natsionalna agentsia za prihodite

    A successful hack does not in itself prove that security fell short; the court assesses the measures concretely and the controller must prove they were appropriate. Fear of misuse can be non-material damage.

  • 14 December 2023 · C-456/22 · CJEU
    Gemeinde Ummendorf

    National rules may not set a de minimis threshold for non-material damage. The data subject must still show damage that goes beyond the infringement itself.

Line of case lawCompensation under Article 82

When does the data subject get compensation?

  1. Österreichische Post (damages) (2023)Three conditions: infringement, damage and causation; no seriousness threshold.
  2. Natsionalna agentsia za prihodite (2023)After a hack, fear of misuse can be damage; the controller proves its measures.
  3. Gemeinde Ummendorf (2023)No minimum threshold, but damage must be shown.
  4. Krankenversicherung Nordrhein (2023)Compensation compensates and does not punish.
  5. MediaMarktSaturn (2024)A purely hypothetical risk is not damage.
  6. juris (2024)An employee's error does not release the controller.
  7. Scalable Capital (2024)Damage from a data breach is not by nature less serious than injury.
  8. Agentsia po vpisvaniyata (2024)A brief loss of control can be damage.
  9. Patērētāju tiesību aizsardzības centrs (2024)An apology can suffice if it fully repairs the damage.
  10. Quirin Privatbank (2025)Fear or annoyance counts if proven.
  11. Brillen Rottler (2026)Whoever provokes the damage gets nothing.

Checked on 5 November 2026

← Art. 81: Suspension of proceedingsArt. 83: General conditions for imposing administrative fines →

Connections

What connects to Article 82 GDPR

Case law