Skip to content
RGPD

Article 82

Right to compensation and liability

1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.

4.   Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.

5.   Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.

6.   Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).

Common Questions

Frequently Asked Questions

Who can claim compensation under Article 82, and for what kind of damage?
Any person who has suffered damage as a result of an infringement of this Regulation has the right to receive compensation, and that covers both material and non-material damage. The claim is directed at the controller or the processor for the damage suffered.
When is a processor liable, and when is it the controller?
Any controller involved in processing is liable for the damage caused by processing which infringes this Regulation. A processor is liable only in two situations: where it has not complied with obligations of this Regulation specifically directed to processors, or where it has acted outside or contrary to the lawful instructions of the controller.
What happens when several controllers or processors are involved in the same processing?

Where more than one controller or processor, or both a controller and a processor, are responsible for damage caused by the same processing, each of them is held liable for the entire damage. The point is to ensure effective compensation of the data subject.

A controller or processor that has paid full compensation can then claim back from the others involved in the same processing the part of the compensation corresponding to their part of responsibility for the damage.

Can a controller or processor escape liability, and where are court proceedings brought?
Yes, but the bar is high: it must prove that it is not in any way responsible for the event giving rise to the damage. Court proceedings for exercising the right to receive compensation are brought before the courts competent under the law of the Member State referred to in Article 79(2).
← Article 81 Article 83 →