What it asks for. Any person who has suffered material or non-material damage as a result of an infringement of the regulation has the right to receive compensation from the controller or processor. A processor is liable only where it has not complied with obligations specific to processors or has acted outside or contrary to the controller's lawful instructions. A controller or processor is exempt if it proves it is not in any way responsible for the event that gave rise to the damage.
In practice. Organisations account for civil claims, including collective actions where national law allows them, in privacy risk assessments alongside regulatory exposure. Clear allocation of responsibilities in controller and processor contracts, good documentation and effective breach response all reduce exposure. Evidence includes contracts, incident records and records of the measures in place at the time.
Common gaps. Organisations often underestimate non-material damage claims after breaches. Contract liability terms with processors are frequently unclear.