Fiche 52/54 Part 5 — Operational Obligations & Sanctions Advanced Reviewed 2026-08-23

Civil Liability & Right to Compensation (Art. 82)

Any person who has suffered material or non-material damage as a result of a GDPR infringement has the enforceable right to receive full judicial compensation from the controller or processor.

Open in interactive reader

⚖️ Binding Standard (Art. 82) 🏛️ CJUE Österreichische Post C-300/21 🏛️ CJUE MediaMarktSaturn C-687/21

Civil Liability & Right to Compensation (Art. 82)

⚡ In 30 seconds

Beyond administrative fines imposed by regulators, the GDPR paves the way for direct civil claims by affected data subjects and collective class actions.

Exemption from Liability (Art. 82.3)

A controller or processor is exempted from liability only if it proves that it is in no way responsible for the event giving rise to the damage (e.g. force majeure, external third-party criminal act without fault).

Collective Representation (Art. 80)

Data subjects have the right to mandate not-for-profit bodies, organisations, or consumer associations to lodge complaints or seek judicial remedies on their behalf.

⚡ Key Takeaways

Compensation explicitly covers non-material damage (e.g., emotional distress, reputational harm, or fear caused by exposure).
Joint and several liability: claimants may sue either the controller or processor, leaving them to seek apportionment internally.
The CJEU clarified that non-material damage must be genuine but does not require meeting any minimum severity threshold (C-300/21).

⚠️ Common Pitfall

Assuming a claimant must prove financial loss to obtain compensation; mere demonstrable loss of control over personal data can warrant damages.

🛠️ Practical Action

Incorporate clear indemnification and liability apportionment clauses in processor contracts to manage cross-recourse claims efficiently.

⚖️ Official sources: Art. 82 GDPR · Recital 146 · CJEU C-300/21 · CJEU C-687/21 ✓ Last legal review: 23 August 2026