Article 82 GDPR (Right To Compensation And Liability)

Article 82 of GDPR: Right To Compensation And Liability

Article 82 of GDPR lays the foundation that any person who suffers damages, whether material or non-material, as a result of the infringement of GDPR obligations is entitled to get compensation.

Right to compensation for material and non-material damages (Article 82(1) GDPR)

Article 82(1) of GDPR provides that any person who suffers damages as a result of GDPR infringement is entitled to get compensation for such damages from the data controller or data processor.

GDPR further states that the damages can be material or even non-material.

Controller and processor liability (Article 82(2) GDPR)

Article 82(2) of GDPR clarifies the liability of data controllers and data processors.

Data controllers are liable for any damages caused by the processing of personal data under GDPR.

A data processor will be liable for damages when:

  1. It has not complied with the processor obligations under GDPR
  2. It has processed data outside of the instructions from the data controller
  3. It has processed data contrary to lawful instructions from the data controller

Exemption of controller or processor liability (Article 82(3) GDPR)

A data controller and a data processor can be exempt from any liability under GDPR if they can prove that they were not responsible for the event giving rise to the damage.

Liability of multiple controllers or processors (Article 82(4) GDPR)

When more than one data controller or data processor, or both, are involved in the same processing activities giving rise to damages, each of the data controller and data processor can be held liable for the entire amount so the data subject can get effective compensation.

Claims between controllers and processors (Article 82(5) GDPR)

In the event a data controller or data processor pays the data subject’s damages, it can claim from any other controller or processor involved in the processing activity their share of damages based on their corresponding level of responsibility. 

Competent court (Article 82(6) GDPR)

Any person is entitled to bring legal action against a data controller or processor to get compensation for damages before the competent court of any EU member state.

Recitals applicable to Article 82 of GDPR

Relevant Recitals: 146, 147

GDPR Regulation article-by-article overview

Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.

Cited Legislation in Article 82 or relevant recitals

Regulation (EU) No 1215/2012

GDPR Text: Article 82 of GDPR and Relevant Recitals

GDPR Text Source: EUR-Lex

Official GDPR Text: General Data Protection Regulation 

Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)