Art. 82 GDPR · Chapter VIII: Remedies, liability and penalties
Article 82 GDPR: Right to compensation and liability
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to receive compensation from the controller or processor. A processor is liable only where it has not complied with obligations specifically directed to processors or has acted outside or contrary to the controller's lawful instructions, and a controller or processor is exempt if it proves that it is not in any way responsible for the event giving rise to the damage.
Official text
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.
Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.
Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.
Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-526/24, Brillen Rottler GmbH & Co. KG v TC
Judgment of 19 March 2026ECLI:EU:C:2026:216
Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown.
- C-655/23, IP v Quirin Privatbank AG
Judgment of 4 September 2025ECLI:EU:C:2025:655
The GDPR does not itself give a right to a court order stopping future unlawful processing, though national law may; negative feelings from loss of control can be damage if proven; fault and any injunction cannot reduce compensation.
- C-200/23, Agentsia po vpisvaniyata v OL
Judgment of 4 October 2024ECLI:EU:C:2024:827
A commercial register that publishes company documents is a controller and recipient of the personal data in them; it cannot refuse erasure of unrequired data; loss of control can be non-material damage.
- C-507/23, A v Patērētāju tiesību aizsardzības centrs
Judgment of 4 October 2024ECLI:EU:C:2024:854
An apology can be sufficient compensation for non-material damage where it fully compensates the harm; the controller's attitude and motives cannot reduce compensation.
- C-590/22, AT and BT v PS GbR and Others
Judgment of 20 June 2024ECLI:EU:C:2024:536
A proven fear that data were disclosed to third parties can be non-material damage even without proof of actual disclosure; damages do not have a punitive function.
- C-182/22, JU and SO v Scalable Capital GmbH
Judgment of 20 June 2024ECLI:EU:C:2024:531
Damages under Art. 82 are purely compensatory; non-material damage from a breach is not by nature less significant than physical injury; small damage may receive small compensation; 'identity theft' requires actual misuse of identity.
- C-741/21, GP v juris GmbH
Judgment of 11 April 2024ECLI:EU:C:2024:288
Infringement alone is not damage; the controller cannot escape liability by blaming an employee acting under its authority; fine criteria in Art. 83 are not used to set damages.
- C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH
Judgment of 25 January 2024ECLI:EU:C:2024:72
Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage.
- C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts
Judgment of 21 December 2023ECLI:EU:C:2023:1022
A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault.
- C-340/21, VB v Natsionalna agentsia za prihodite
Judgment of 14 December 2023ECLI:EU:C:2023:986
A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage.
- C-456/22, VX and AT v Gemeinde Ummendorf
Judgment of 14 December 2023ECLI:EU:C:2023:988
National rules may not impose a de minimis threshold for non-material damage, but the person must show consequences beyond the mere infringement.
- C-300/21, UI v Österreichische Post AG
Judgment of 4 May 2023ECLI:EU:C:2023:370
A breach of the GDPR alone does not give a right to compensation: damage and causation must be shown, but there is no seriousness threshold; the amount follows national rules, subject to EU principles.