GDPR Compensation Claims: When Does Non-Material Damage Qualify?

What does Article 82 GDPR actually give you?

Article 82(1) GDPR gives "any person who has suffered material or non-material damage as a result of an infringement of this Regulation" the right to receive compensation from the controller or processor responsible. Material damage covers quantifiable losses like fraud or fees you had to pay; non-material damage covers everything else — distress, loss of control over your data, reputational harm. The GDPR treats the two as equals: neither is a lesser or "backup" category, and Article 82(1) does not require you to have suffered financial loss before non-material damage becomes available to you.

Do you have to prove you lost money to claim compensation?

No — non-material damage is enough on its own. The CJEU's first Article 82 ruling, Case C-300/21 (Österreichische Post AG, 4 May 2023), set out three cumulative conditions a claimant must meet: (1) an infringement of the GDPR, (2) damage — material or non-material — actually suffered, and (3) a causal link between the two. Mere infringement of the GDPR, without any of these being shown, does not by itself create a right to compensation; but where all three are shown, no separate proof of financial loss is required.

Is there a minimum level of seriousness your distress must reach?

No formal "de minimis" threshold exists. Case C-300/21 already held that Article 82(1) does not require non-material damage to reach any particular degree of seriousness, and Case C-655/23 (IP v Quirin Privatbank AG, 4 September 2025) confirmed this again: national courts cannot make compensation conditional on the harm being sufficiently severe. This does not mean any complaint automatically succeeds — you still have to actually demonstrate that you experienced real damage and that it was caused by the specific infringement, not merely assert that a breach happened. A more recent ruling, Case C-526/24 (Brillen Rottler, 19 March 2026), reinforced exactly this point: the Court held, in substance, that damage cannot be presumed merely because a violation took place, and that simply asserting fear or anxiety is not on its own enough — you have to prove concrete negative consequences, not just state that you felt worried.

Does losing control of your data count, even without proven misuse?

Yes — the CJEU has confirmed that a mere loss of control over personal data can itself be non-material damage, even if no one is shown to have actually misused it. In Case C-655/23, the Court held that negative feelings such as fear or annoyance caused by a loss of control over data are capable of constituting non-material damage under Article 82(1), provided the data subject demonstrates that they are actually experiencing those feelings and that this is precisely because of the infringement in question. A purely abstract, hypothetical worry that something bad might one day happen is not the same as demonstrating you actually feel that way because of what occurred.

Does it matter how careless or reckless the controller was?

Not for how much you receive. Case C-655/23 held that the degree of the controller’s fault must not be taken into account when a court assesses the amount of compensation payable under Article 82(1). Article 82 is compensatory, not punitive: it exists to make good the damage you actually suffered, not to punish sloppier controllers with bigger payouts — that punitive function belongs to the administrative fines regime under Article 83 instead.

Can you get a court injunction and compensation at the same time?

Yes — they are independent remedies. Case C-655/23 confirmed that obtaining a court order to stop further unlawful processing does not reduce or replace compensation for damage you have already suffered. An injunction is forward-looking (it prevents new harm); compensation is backward-looking (it repairs harm already done). Winning one does not use up or diminish your entitlement to the other.

Controller, processor, or both: who do you actually sue?

Usually the controller — a processor is only liable in narrower circumstances. Under Article 82(2), a controller is liable for damage caused by processing that infringes the GDPR, while a processor is liable only for damage caused by processing where it has not complied with obligations specifically addressed to processors, or where it has acted outside or contrary to the controller’s lawful instructions. Either can escape liability under Article 82(3) by proving it is "not in any way responsible for the event giving rise to the damage." Where more than one controller or processor was involved in the same processing, Article 82(4) makes each of them liable for the entire damage, so you do not have to work out and apportion blame yourself — whoever you claim against can later use Article 82(5) to recover its share back from the others. As for where and when: Article 82(6) only points you to the courts competent under Article 79(2) (broadly, the Member State where the defendant is established, or where you have your habitual residence) — the GDPR itself sets no EU-wide limitation period, so how long you have to actually bring the claim depends on the civil procedure rules of that Member State.

Checklist: do you have a viable Article 82 claim?

Run through these six cumulative questions, built directly from the C-300/21, C-655/23 and C-526/24 case law above — a "no" on any of the first three, or a "yes" on the last one, is normally fatal to the claim.

• 1. Infringement — can you point to an actual breach of a specific GDPR provision (e.g. unlawful disclosure, missing legal basis, a security failure under Article 32)?
• 2. Damage — can you describe real damage you experienced (distress, fear, loss of control, or a financial loss), not just the fact that a breach occurred?
• 3. Causal link — can you connect that specific damage to that specific infringement, rather than to general life anxieties or unrelated events?
• 4. No threshold to clear — you do not need to prove the damage was "serious," but you do need it to be genuine and demonstrated, not merely alleged.
• 5. Right defendant — identify whether the controller, a processor that breached its own duties, or both, are the correct target under Article 82(2)–(4).
• 6. No self-manufactured claim — did the infringement happen to you, or did you engineer the situation (e.g. deliberately triggering a request) purely to create grounds for a payout? Case C-526/24 (Brillen Rottler, 19 March 2026) confirms that where your own conduct is the determining cause of the "damage," the causal link is broken and the claim fails.

Frequently asked questions