Article 82 of GDPR: Right To Compensation And Liability
Article 82 of GDPR lays the foundation that any person who suffers damages, whether material or non-material, as a result of the infringement of GDPR obligations is entitled to get compensation.
Right to compensation for material and non-material damages (Article 82(1) GDPR)
Article 82(1) of GDPR provides that any person who suffers damages as a result of GDPR infringement is entitled to get compensation for such damages from the data controller or data processor.
GDPR further states that the damages can be material or even non-material.
Controller and processor liability (Article 82(2) GDPR)
Article 82(2) of GDPR clarifies the liability of data controllers and data processors.
Data controllers are liable for any damages caused by the processing of personal data under GDPR.
A data processor will be liable for damages when:
- It has not complied with the processor obligations under GDPR
- It has processed data outside of the instructions from the data controller
- It has processed data contrary to lawful instructions from the data controller
Exemption of controller or processor liability (Article 82(3) GDPR)
A data controller and a data processor can be exempt from any liability under GDPR if they can prove that they were not responsible for the event giving rise to the damage.
Liability of multiple controllers or processors (Article 82(4) GDPR)
When more than one data controller or data processor, or both, are involved in the same processing activities giving rise to damages, each of the data controller and data processor can be held liable for the entire amount so the data subject can get effective compensation.
Claims between controllers and processors (Article 82(5) GDPR)
In the event a data controller or data processor pays the data subject’s damages, it can claim from any other controller or processor involved in the processing activity their share of damages based on their corresponding level of responsibility.
Competent court (Article 82(6) GDPR)
Any person is entitled to bring legal action against a data controller or processor to get compensation for damages before the competent court of any EU member state.
Recitals applicable to Article 82 of GDPR
Relevant Recitals: 146, 147
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 82 or relevant recitals
GDPR Text: Article 82 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection RegulationÂ
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
