What is Article 82 of the General data Protection Regulation?

Asked by: Dan Considine V  |  Last update: May 30, 2026
Score: 4.8/5 (46 votes)

Article 82 of the GDPR establishes the Right to Compensation and Liability, allowing individuals to claim damages (material or non-material, like distress) from data controllers or processors if their GDPR rights are infringed, making them responsible for processing that violates the regulation, with processors liable if they fail their specific obligations or act against controller instructions. It ensures that anyone harmed by a data breach or non-compliance can seek effective compensation, even for non-material damages, by holding responsible parties accountable.

What is Article 82 of the GDPR?

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

How do I comply with article 82?

To meet Article 82, your records must be-at all times-current, role-attributed, and actionable.

Am I entitled to compensation for data breaches?

Yes, you can get compensation for a data breach, typically through settlements or lawsuits, covering financial losses (like fraud, monitoring costs) and sometimes non-economic damages (like emotional distress), with specific amounts varying based on harm and state laws (like California's CCPA). Compensation forms range from cash payments (e.g., $15-$100+) and reimbursed expenses (e.g., identity restoration, credit freezes) to years of credit monitoring, often found via class-action settlements for major breaches like Equifax or Capital One. 

Does Article 82 apply to small businesses?

Article 82 of the GDPR states that data subjects have the right to pursue compensation if they experience damages as the result of a company failing to comply with the GDPR. This does not only apply to large companies, but anyone who takes on the responsibility of collecting and processing personal data.

GDPR explained: How the new data protection act could change your life

27 related questions found

Who is exempt from the data protection fee?

If you do not process personal information at all (or you do but not via a computer or other automated system), you are exempt and will not need to pay the fee. You are exempt if you are only processing personal information for any of the reasons below: Staff administration. Advertising, marketing and public relations.

Should I allow legitimate interest?

You can consider using legitimate interests as your lawful basis for such processing. However you need to identify your specific interest underlying the processing and ensure that the processing is actually necessary for that purpose.

What is the average payout for a data breach?

Average compensation for a data breach varies wildly, from modest payouts of $100-$1,500 in large class actions (like Equifax or AT&T) to potentially thousands or tens of thousands for documented losses like fraudulent charges, credit monitoring, or significant time spent resolving issues, with individual lawsuits often yielding more than class actions but being harder to pursue. Payouts hinge on proving actual harm, company negligence, and whether you file an individual claim or join a class action, with higher amounts for severe cases like medical data theft or identity theft.

Is it worth suing over a data breach?

Yes, suing over a data breach can be worth it if you suffer actual, documented harm, like identity theft, financial losses (stolen funds, new loans), significant time spent fixing your credit, or severe emotional distress from constant worry, though individual payouts are often modest and often part of larger class-action lawsuits where payouts are smaller but hold companies accountable. The key is proving the company's negligence caused your specific damages, with highly sensitive data (SSNs, medical records) increasing claim value, making it a personal injury case rather than just a privacy violation. 

How much money do the data breaches give you?

Data breach payouts come from class-action settlements, offering compensation for documented losses (often up to $5,000 or more) or smaller alternative payments (e.g., $85) for simply being affected, plus services like dark web monitoring, with final amounts depending on claim volume, but specific payouts vary by breach (e.g., AT&T, Equifax) and require filing claims through settlement websites by deadlines. 

What is the Article 82 in simple words?

It provided for the Parliament to readjust, after completion of each census, seats allocated to the House of the People to the States and division of each State into territorial constituencies.

What is the significance of article 82?

Article 82 of the United Nations Convention on the Law of the Sea (UNCLOS) obligates coastal states to make payments to the international community in respect of the exploitation of non-living resources of the extended continental shelf beyond 200 nautical miles.

What is the name of the rule that is used in data breach compensation claims?

The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law.

Can you sue a company for a data leak?

Breached Organizations

The company that stored your data may be held accountable through a civil lawsuit if it can be established that the company failed to use adequate security measures to protect that data stored in its network.

What qualifies a data breach as an eligible data breach?

Eligible data breaches in the National Scheme

For a data breach to be eligible, and therefore require notification to our office, it must be: likely to result in serious harm to any individual. that remedial action taken by the organisation has not successfully prevented the likely risk of serious harm.

What are 5 examples of personal data?

What is personal data?

  • a name and surname.
  • a home address.
  • an email address such as 'name.surname@company.com '
  • an Internet Protocol (IP) address.
  • an identification card number.
  • a cookie ID.
  • the advertising identifier of your phone.
  • data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.

What if my SSN was part of a data breach?

If your SSN is exposed in a data breach, immediately place a credit freeze with all three bureaus (Equifax, Experian, TransUnion) to block new credit, set up fraud alerts, monitor financial/credit accounts closely, and report it to the FTC at IdentityTheft.gov for a recovery plan, potentially filing a police report if fraud occurs. Also, secure online accounts with 2FA and watch for IRS or phishing attempts. 

What is the average settlement for a data breach?

Average compensation for a data breach varies wildly, from modest payouts of $100-$1,500 in large class actions (like Equifax or AT&T) to potentially thousands or tens of thousands for documented losses like fraudulent charges, credit monitoring, or significant time spent resolving issues, with individual lawsuits often yielding more than class actions but being harder to pursue. Payouts hinge on proving actual harm, company negligence, and whether you file an individual claim or join a class action, with higher amounts for severe cases like medical data theft or identity theft.

How hard is it to win a breach of contract lawsuit?

Winning a breach of contract lawsuit is challenging, requiring proof of a valid contract, your performance, the other party's failure, and resulting damages, all while navigating potential counterclaims, defenses (like unwritten agreements or mistakes), and the high costs, time, and stress of litigation; essentially, it's hard because you need a solid, documented case and must overcome the opposing side's efforts and legal hurdles. 

Do I need a lawyer for a data breach settlement?

Take action quickly because the sooner you fight back, the better your chances of recovering damages. The first step you should take is to consult an expert attorney to go after liable parties and seek compensation on your behalf. How Long Does a Data Breach Lawsuit Typically Take?

Am I entitled to compensation for a data breach?

Yes, you can get compensation for a data breach, typically through settlements or lawsuits, covering financial losses (like fraud, monitoring costs) and sometimes non-economic damages (like emotional distress), with specific amounts varying based on harm and state laws (like California's CCPA). Compensation forms range from cash payments (e.g., $15-$100+) and reimbursed expenses (e.g., identity restoration, credit freezes) to years of credit monitoring, often found via class-action settlements for major breaches like Equifax or Capital One. 

How long do data breach settlements take?

It's hard to pinpoint an exact timeline for a data breach lawsuit. It usually starts with discovering the breach and an initial investigation. While simple cases may progress quickly, it's not unusual for large and high-profile cases to take years to settle, especially if the case goes to trial or is appealed.

Is it better to accept cookies or reject them?

You should generally reject non-essential cookies, especially third-party trackers, but accept essential cookies that make sites work, by using the "Customize" or "Manage Settings" button on pop-ups to allow only necessary ones, and always avoid accepting cookies on non-secure (HTTP) sites or when entering sensitive data. Accepting all cookies enables personalized experiences but allows extensive tracking; rejecting most improves privacy but might limit features. 

What happens if we don't accept cookies?

If you don't accept cookies, you'll likely get a less personalized experience, needing to re-enter details like login info or language preferences, and some site features might not work, though you can often still browse; websites may show the prompt repeatedly or, in some cases, block access to the site entirely, depending on their setup and whether you're declining essential vs. non-essential cookies. 

How do I turn off legitimate interest?

Manage legitimate interest settings

  1. Sign in to Google Ad Manager.
  2. Click Privacy & messaging.
  3. Click. ...
  4. Adjust the "Legitimate interest controls" settings as needed. ...
  5. Adjust the "Turn on by default" setting as needed. ...
  6. Click Save.