Any person who has suffered material or non-material damage as a result of a breach of their data shall have the right to receive compensation from the controller or processor for the damage suffered.
Under data protection law, you are entitled to take your case to court to:
- Enforce your rights under data protection law if you believe they have been breached.
- Claim compensation for any damage caused by any organisation if they have broken data protection law, including any distress you may have suffered, or
- a combination of the two.
Do I have to go to court to get compensation for a breach of data protection law?
The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress).
You do not have to make a court claim to obtain compensation – the organisation may simply agree to pay it to you. However, if it does not agree to pay, your next step would be to make a claim in court. The court would decide your case. If it agreed with you, it would decide whether or not the organisation would have to pay you compensation.