[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F82":3},{"item":4,"lessons":16,"controls":65,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","82","Article 82","Right to compensation and liability",25,"General Data Protection Regulation","**What it asks for.** Any person who has suffered material or non-material damage as a result of an infringement of the regulation has the right to receive compensation from the controller or processor. A processor is liable only where it has not complied with obligations specific to processors or has acted outside or contrary to the controller's lawful instructions. A controller or processor is exempt if it proves it is not in any way responsible for the event that gave rise to the damage.\n\n**In practice.** Organisations account for civil claims, including collective actions where national law allows them, in privacy risk assessments alongside regulatory exposure. Clear allocation of responsibilities in controller and processor contracts, good documentation and effective breach response all reduce exposure. Evidence includes contracts, incident records and records of the measures in place at the time.\n\n**Common gaps.** Organisations often underestimate non-material damage claims after breaches. Contract liability terms with processors are frequently unclear.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_82","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,45,49,53,57,61],{"slug":19,"title":20,"published_at":21},"cjeu-loss-of-control-over-personal-data-qualifies-as-compensable-harm-under-gdpr-article-82","CJEU: Loss of Control Over Personal Data Qualifies as Compensable Harm Under GDPR Article 82","2026-10-12T14:20:50.134+00:00",{"slug":23,"title":24,"published_at":25},"german-federal-court-expands-gdpr-enforcement-national-injunctions-now-permissible-for-unlawful-data","German Federal Court Expands GDPR Enforcement: National Injunctions Now Permissible for Unlawful Data Transfers","2026-09-23T08:21:44.988+00:00",{"slug":27,"title":28,"published_at":29},"german-federal-court-expands-data-subject-remedies-beyond-gdpr","German Federal Court Expands Data Subject Remedies Beyond GDPR","2026-09-22T08:20:18.047+00:00",{"slug":31,"title":32,"published_at":33},"romanian-railway-company-fined-for-refusing-gdpr-data-access-request-1789554040811","Romanian Railway Company Fined for Refusing GDPR Data Access Request","2026-09-16T10:20:40.556+00:00",{"slug":35,"title":36,"published_at":37},"deepfake-pornography-sites-target-100-female-politicians-across-europe","Deepfake Pornography Sites Target 100+ Female Politicians Across Europe","2026-09-14T12:20:42.789+00:00",{"slug":39,"title":40,"published_at":41},"romanian-railways-faces-court-damages-for-gdpr-access-request-refusal","Romanian Railways Faces Court Damages for GDPR Access Request Refusal","2026-08-07T16:21:03.739+00:00",{"slug":43,"title":32,"published_at":44},"romanian-railway-company-fined-for-refusing-gdpr-data-access-request","2026-08-07T14:20:38.513+00:00",{"slug":46,"title":47,"published_at":48},"munich-court-orders-1500-damages-for-unlawful-tracking-via-social-media-business-tools","Munich Court Orders €1,500 Damages for Unlawful Tracking via Social Media Business Tools","2026-07-29T16:21:42.238+00:00",{"slug":50,"title":51,"published_at":52},"eu-commission-fined-50k-for-unlawful-personal-data-in-anti-fraud-press-release","EU Commission Fined €50K for Unlawful Personal Data in Anti-Fraud Press Release","2026-07-29T14:20:40.191+00:00",{"slug":54,"title":55,"published_at":56},"bgh-rules-emotional-distress-alone-sufficient-for-gdpr-damages","BGH Rules Emotional Distress Alone Sufficient for GDPR Damages","2026-07-29T08:20:55.959+00:00",{"slug":58,"title":59,"published_at":60},"german-court-orders-social-network-to-cease-unlawful-third-party-data-collection-and-pay-damages","German Court Orders Social Network to Cease Unlawful Third-Party Data Collection and Pay Damages","2026-07-28T14:20:35.92+00:00",{"slug":62,"title":63,"published_at":64},"german-court-awards-gdpr-damages-after-bank-discloses-applicants-data-to-wrong-party","German Court Awards GDPR Damages After Bank Discloses Applicant's Data to Wrong Party","2026-07-28T10:21:08.956+00:00",[66,71,76,81,86,91],{"slug":67,"name":68,"problem":69,"stories":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",9,{"slug":72,"name":73,"problem":74,"stories":75},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",8,{"slug":77,"name":78,"problem":79,"stories":80},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",4,{"slug":82,"name":83,"problem":84,"stories":85},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",2,{"slug":87,"name":88,"problem":89,"stories":90},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",1,{"slug":92,"name":93,"problem":94,"stories":90},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[96,102,107,112,116,121,125,130],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","3","Control 3","Data Protection",20,{"family":103,"item":104,"code":105,"title":105,"together":106},"itil","overview","ITIL",17,{"family":108,"item":104,"code":109,"title":110,"together":111},"nist-privacy","Privacy Framework","NIST Privacy Framework",12,{"family":5,"item":113,"code":114,"title":115,"together":70},"6","Article 6","Lawfulness of processing",{"family":117,"item":118,"code":119,"title":120,"together":70},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":5,"item":122,"code":123,"title":124,"together":70},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":126,"item":127,"code":128,"title":129,"together":75},"nist-800-53","ac-3","AC-3","Access Enforcement",{"family":5,"item":131,"code":132,"title":133,"together":134},"15","Article 15","Right of access by the data subject",6]