--- title: "Art. 82 GDPR: Right to compensation and liability" canonical: "https://dposchool.com/gdpr/article/82" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_82" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 82 GDPR · Chapter VIII: Remedies, liability and penalties # Article 82 GDPR: Right to compensation and liability Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to receive compensation from the controller or processor. A processor is liable only where it has not complied with obligations specifically directed to processors or has acted outside or contrary to the controller's lawful instructions, and a controller or processor is exempt if it proves that it is not in any way responsible for the event giving rise to the damage. ## Official text ### Article 82(1) **1.** Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. ### Article 82(2) **2.** Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller. ### Article 82(3) **3.** A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage. ### Article 82(4) **4.** Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject. ### Article 82(5) **5.** Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2. ### Article 82(6) **6.** Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2). ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 82 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_82) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 146](https://dposchool.com/gdpr/recital/146) ## Court of Justice judgments ### [C-526/24, Brillen Rottler GmbH & Co. KG v TC](https://dposchool.com/gdpr/case/c-526-24) Judgment of 19 March 2026 · ECLI:EU:C:2026:216 Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-526/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0526) ### [C-655/23, IP v Quirin Privatbank AG](https://dposchool.com/gdpr/case/c-655-23) Judgment of 4 September 2025 · ECLI:EU:C:2025:655 The GDPR does not itself give a right to a court order stopping future unlawful processing, though national law may; negative feelings from loss of control can be damage if proven; fault and any injunction cannot reduce compensation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-655/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0655) ### [C-200/23, Agentsia po vpisvaniyata v OL](https://dposchool.com/gdpr/case/c-200-23) Judgment of 4 October 2024 · ECLI:EU:C:2024:827 A commercial register that publishes company documents is a controller and recipient of the personal data in them; it cannot refuse erasure of unrequired data; loss of control can be non-material damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-200/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0200) ### [C-507/23, A v Patērētāju tiesību aizsardzības centrs](https://dposchool.com/gdpr/case/c-507-23) Judgment of 4 October 2024 · ECLI:EU:C:2024:854 An apology can be sufficient compensation for non-material damage where it fully compensates the harm; the controller's attitude and motives cannot reduce compensation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-507/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0507) ### [C-590/22, AT and BT v PS GbR and Others](https://dposchool.com/gdpr/case/c-590-22) Judgment of 20 June 2024 · ECLI:EU:C:2024:536 A proven fear that data were disclosed to third parties can be non-material damage even without proof of actual disclosure; damages do not have a punitive function. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-590/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0590) ### [C-182/22, JU and SO v Scalable Capital GmbH](https://dposchool.com/gdpr/case/c-182-22) Judgment of 20 June 2024 · ECLI:EU:C:2024:531 Damages under Art. 82 are purely compensatory; non-material damage from a breach is not by nature less significant than physical injury; small damage may receive small compensation; 'identity theft' requires actual misuse of identity. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-182/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0182) ### [C-741/21, GP v juris GmbH](https://dposchool.com/gdpr/case/c-741-21) Judgment of 11 April 2024 · ECLI:EU:C:2024:288 Infringement alone is not damage; the controller cannot escape liability by blaming an employee acting under its authority; fine criteria in Art. 83 are not used to set damages. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-741/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741) ### [C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH](https://dposchool.com/gdpr/case/c-687-21) Judgment of 25 January 2024 · ECLI:EU:C:2024:72 Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-687/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687) ### [C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts](https://dposchool.com/gdpr/case/c-667-21) Judgment of 21 December 2023 · ECLI:EU:C:2023:1022 A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-667/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0667) ### [C-340/21, VB v Natsionalna agentsia za prihodite](https://dposchool.com/gdpr/case/c-340-21) Judgment of 14 December 2023 · ECLI:EU:C:2023:986 A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-340/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340) ### [C-456/22, VX and AT v Gemeinde Ummendorf](https://dposchool.com/gdpr/case/c-456-22) Judgment of 14 December 2023 · ECLI:EU:C:2023:988 National rules may not impose a de minimis threshold for non-material damage, but the person must show consequences beyond the mere infringement. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-456/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0456) ### [C-300/21, UI v Österreichische Post AG](https://dposchool.com/gdpr/case/c-300-21) Judgment of 4 May 2023 · ECLI:EU:C:2023:370 A breach of the GDPR alone does not give a right to compensation: damage and causation must be shown, but there is no seriousness threshold; the amount follows national rules, subject to EU principles. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-300/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VIII](https://dposchool.com/gdpr/chapter/8) / Article 82 Previous: [Art. 81 GDPR: Suspension of proceedings](https://dposchool.com/gdpr/article/81) Next: [Art. 83 GDPR: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents