A privacy violation can have concrete consequences: unexpected expenses, disclosure of confidential information, loss of control over data, fear of fraud, or damage to reputation. If you have received a communication regarding a data breach, or if you have discovered that your data has been used or transmitted without a valid reason, it is natural to ask yourself whether you can obtain compensation and what evidence you need to gather.
In this guide, I want to clarify when the right to compensation arises, why mere non-compliance with the GDPR is not enough, and how to distinguish economic damage from non-material damage. We will also see what changes when the violation depends on a cyberattack, what remedies can stop the processing, and what relationship exists between the complaint to the supervisory authority and legal action before the court.
When a violation gives the right to compensation
Compensation requires three connected elements: a violation of the GDPR, material or non-material damage actually suffered, and a causal link between the two. Article 82 of Regulation (EU) 2016/679 therefore does not automatically award a sum of money every time a rule on data processing is disregarded.
The violation may consist, for example, in the use of data without an adequate legal basis, communication to unauthorized recipients, retention beyond the permitted period, or the adoption of inadequate security measures. A data breach is not strictly necessary: even intentional but unlawful processing can cause compensable damage.
A data breach is a particular security breach that leads, accidentally or unlawfully, to the destruction, loss, modification, unauthorized disclosure of, or access to data. Both a cyberattack and sending a document to the wrong person fall within this definition. The technical cause alone does not decide the claim: it is necessary to understand which data were involved and what consequences derived from them for you.
The Court of Justice, in the judgment of 4 May 2023, case C-300/21, clarified two complementary aspects. Mere violation of the GDPR is not enough, because the damage must exist and be proven; at the same time, non-material damage does not have to exceed a minimum threshold of severity. Minor damage may be compensable, but it is not presumed.
Economic damage and non-material damage
Material damage is an economically assessable loss. It may include money stolen through fraud linked to compromised data, expenses necessary to limit the consequences of the unlawful act, or other financial losses. The request must show why that cost stems from the violation and not from an independent event.
Non-material damage affects the personal sphere. Loss of control over data, prejudice to reputation, humiliation caused by third parties becoming aware of confidential information, anxiety about potential abuse, or distress linked to the exposure of particularly sensitive data may become relevant. There is no closed list valid for every situation.
The fear of future use may constitute damage when it is founded on concrete circumstances. It matters, for example, whether identity documents, credentials, financial information, or data usable for fraud have been stolen. Concern linked to a recognizable risk is different from mere irritation over the failure to respect a rule.
There is no automatic tariff based on the number of data items, the duration of the processing, or the size of the responsible organization. The compensation provided for by Article 82 has a compensatory function, not a punitive one. The amount must reflect the prejudice concretely suffered: the nature of the data, dissemination, duration, and consequences matter to the extent that they help describe that prejudice.
How to prove damage and the causal link
Proof starts from a precise reconstruction of events. Useful elements include the data breach communication, requests sent to the controller, the controller's responses, account access alerts, suspicious messages, and any element allowing the violation and the claimed consequences to be placed in time.
For economic damage, documents showing the loss or expense are normally required: bank statements, receipts, invoices, transaction disputes, and communications with banks or suppliers. The economic document is not enough without the causal connection. A fraudulent charge following a data breach must be compared with the stolen data and the methods used for the fraud.
For non-material damage, the GDPR does not impose a single means of proof. However, the description must be concrete and consistent: the duration of the distress, the measures adopted to protect oneself, the confidential nature of the information, and the risk of abusive use help the judge distinguish actual prejudice from generic annoyance.
Anyone claiming compensation must prove the violation, the damage, and the relationship between them. The controller can be released from the liability provided for by Article 82 only by proving that they are not in any way responsible for the event that caused the damage. The burden of proof does not fall entirely on a single party: the controller must provide elements relating to the measures and activities within their own organization.
Cyberattacks and controller liability
A cyberattack does not automatically prove that defenses were inadequate, nor does it automatically release the controller. Articles 24 and 32 of the GDPR require technical and organizational measures appropriate to the risk, considering the type of processing, the context, the state of the art, costs, and the probability and severity of the consequences for individuals.
The judgment of the Court of Justice of 14 December 2023, case C-340/21, clarifies that the controller cannot limit themselves to blaming hackers. They must prove the adequacy of the measures adopted and, to be exempted from compensation, their total lack of involvement in the cause of the damage. Liability depends on the measures concretely implemented, not solely on the external origin of the attack.
The controller must notify the supervisory authority of the violation without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals. If the risk is high, they must also inform the data subject without undue delay. The 72-hour timeframe concerns the controller: it is not the deadline within which you must request compensation.
The communication received is important, but it does not necessarily represent an admission of liability and does not prove the damage on its own. Categories of data, the period concerned, potential recipients, indicated consequences, and adopted measures all matter. Access, copying, and dissemination are not the same thing: this distinction can change the assessment of risk and prejudice.
Remedies available beyond claiming money
Stopping or correcting the processing can be a priority. Depending on the situation, you can request access to data and information on their use, rectification, erasure, restriction, or object to the processing. The appropriate right depends on the reason why the data are processed: erasure, for example, encounters limits when retention is required by law or serves to establish, exercise, or defend a legal claim.
The request to the controller can serve both to obtain a concrete measure and to understand what happened. It is useful to identify the contested data and processing, avoiding questions so generic as to make the subject matter uncertain. The response can provide evidentiary elements, but the controller's silence does not allow the existence and amount of the damage to be automatically presumed.
The complaint to the supervisory authority and the claim for damages have different functions. The complaint aims at establishing the violation and adopting measures within the authority's competence; compensation is recognized by the ordinary court. Article 152 of the Personal Data Protection Code also assigns disputes regarding compensation provided for under Article 82 of the GDPR to the ordinary judicial authority.
Disputes follow the rules of Article 10 of Legislative Decree 150/2011. Jurisdiction lies alternatively with the court of the place where the controller resides or has its registered office and that of the data subject's residence. The thirty-day term provided for challenging a decision of the authority is not the general deadline for the claim for damages.
How to set up the claim without weakening it
The first mistake is asking for a figure without explaining the damage. The number of data items involved or the presence of sensitive information does not automatically determine the amount. An understandable request separates economic losses from personal consequences and links each item to the contested violation.
The second mistake is deleting messages, screenshots, or communications after securing accounts. Protecting oneself comes first, but the orderly preservation of evidence remains essential. It is advisable to note when you learned the news, what measures you adopted, and what subsequent events may have a relationship with the compromised data.
The third mistake is confusing the claim for damages with the measures necessary to stop the unlawful act. Erasure, restriction, rectification, and compensation respond to different needs. The cessation of processing does not replace the remedy for damage already suffered, just as the financial claim does not eliminate the need to prevent further dissemination.
Frequently asked questions
Does every data breach give the right to compensation?
No, a data breach is not enough on its own. You must prove a violation of the GDPR, actual material or non-material damage, and the causal link between them. Even limited damage can be compensable, but the simple news that some data have been involved does not automatically entail the payment of a sum.
Can I be compensated for the fear of future use of data?
Yes, if the prejudice is real and proven. The fear of abusive use can constitute non-material damage when it is well-founded with respect to the compromised data and the circumstances of the event. It is necessary to explain the negative consequences concretely suffered and their relationship with the violation, rather than simply recalling generic anxiety.
How is compensation calculated?
The GDPR does not provide fixed amounts. The judge considers the damage actually suffered according to applicable rules, in compliance with the compensatory function of compensation. The nature of the data, the duration of the loss of control, dissemination, and consequences can influence the outcome because they describe the prejudice, not as an additional penalty against the controller.
Does the complaint to the authority allow me to obtain compensation?
The complaint does not replace the claim before the court. The authority can ascertain violations and adopt measures within its competence, while compensation pursuant to Article 82 is recognized by the ordinary judicial authority. The outcomes of the complaint can be relevant, but damage and causal link must still be proven.
Must I act within 72 hours of discovering the data breach?
No, the 72 hours concern the controller's notification to the supervisory authority, when conditions are met. They are not the deadline assigned to the data subject to request compensation. However, it is important to preserve evidence immediately and distinguish the deadlines of the specific action from those provided for challenging a decision of the authority.
When I can help you clarify the situation
The assessment is useful when it is necessary to connect data, event, and consequences. To prepare for it, you can gather the controller's communication, requests already sent, responses received, and documents relating to expenses, fraud, or other effects of the violation. If you want to understand which remedies are suitable for your situation and how to set up the proof, you can contact me.