Article 82 GDPR
Right to compensation and liability

1. Any person who has suffered pecuniary or non-pecuniary damage as a result of a violation of this Regulation shall have the right to obtain compensation from the controller or processor for the damage suffered.

2. Any controller involved in processing shall be liable for damages caused by processing in violation of this Regulation. A processor shall be liable for damages caused by processing only if it has failed to comply with the obligations that this Regulation imposes directly on processors, or if it has acted outside of or contrary to the lawful instructions of the controller.

3. The controller or processor shall be released from liability under paragraph 2 if they prove that they are in no way at fault for the event that led to the damage.

4. If more than one controller or processor is involved in the same processing, or both a controller and a processor are involved, and they are liable for the damage caused by the processing in accordance with paragraphs 2 and 3, they shall be jointly and severally liable for the entire damage so as to ensure that the data subject is actually compensated.

5. An administrator or processor who has paid compensation for the entire damage caused in accordance with paragraph 4 shall have the right to claim from the other administrators or processors who participated in the same processing a portion of the compensation corresponding to the portion of the damage for which they are responsible, in accordance with the conditions set forth in paragraph 2.

6. Legal proceedings for damages shall be brought before the court having jurisdiction under the law of the Member State referred to in Article 79(2).