§ GDPR · Article 82
GDPR Article 82: Obligations, Deadlines & Penalties
At a glance
Article 82 of the GDPR imposes 5 obligations on controller, controller or processor, processor.
§ Obligations
All obligations under Article 82
Obligation 1
The controller or processor must provide compensation to any person who has suffered material or non-material damage as a result of an infringement of the Regulation.
Regulation (EU) 2016/679, Article 82, Article 82
- Obligated entity
-
controller or processor
- Action required
-
compensate
- Deadline
-
—
- Penalty
-
—
Obligation 2
The controller is liable for damage caused by processing which infringes the Regulation, unless it proves it is not in any way responsible for the event giving rise to the damage.
Regulation (EU) 2016/679, Article 82, Article 82
- Obligated entity
-
controller
- Action required
-
be liable
- Deadline
-
—
- Penalty
-
—
- Exemptions
- if it proves that it is not in any way responsible for the event giving rise to the damage
Obligation 3
The processor is liable for damage caused by processing only where it has not complied with obligations specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
Regulation (EU) 2016/679, Article 82, Article 82
- Obligated entity
-
processor
- Action required
-
be liable
- Deadline
-
—
- Penalty
-
—
- Exemptions
- if it proves that it is not in any way responsible for the event giving rise to the damage
Obligation 4
Where multiple controllers or processors are involved and responsible for damage, each shall be held liable for the entire damage to ensure effective compensation of the data subject.
Regulation (EU) 2016/679, Article 82, Article 82
- Obligated entity
-
controller or processor
- Action required
-
be liable
- Deadline
-
—
- Penalty
-
—
Obligation 5
A controller or processor that has paid full compensation is entitled to claim back from other involved controllers or processors the part of the compensation corresponding to their part of responsibility.
Regulation (EU) 2016/679, Article 82, Article 82
- Obligated entity
-
controller or processor
- Action required
-
claim back
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 82
Who must comply with Article 82 of the GDPR?
+
controller, controller or processor, processor.
What does Article 82 of the GDPR require?
+
compensate be liable claim back