Introducing GDPR’s liabilities and sanctions

If controllers and processors fail to comply with the GDPR there can be negative consequences. Liability and sanctions are an important part of the GDPR.

In accordance with the provisions in Chapter VIII, controllers and processors are legally liable for damages caused by data processing activities which infringe the GDPR. A controller is liable for all damages caused by processing activities. A processor is liable for not complying with its obligations or for acting outside or contrary to lawful instructions of a controller. A data subject who has suffered material or non-material damages as a result of a violation of the GDPR has the right to receive compensation for damages, as discussed in the previous week. There are always judicial remedies against decisions which impose liabilities and sanctions. It is however best to avoid such decisions.

In case of infringement of the GDPR controllers and processors may face heavy administrative fines: up to 10 or 20 million euro or 2 or 4% of the undertaking’s total worldwide annual turnover of the previous financial year depending on the circumstances (see Article 83).

In addition, EU Member States can make rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in their territory and lay down rules on other penalties applicable to infringements of the GDPR, in particular the infringements that are not subject to administrative fines. National laws are thus equally important.