I need to bring my Luxembourg organisation into compliance with article 82 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 82

Right to compensation and liability

General Data Protection Regulation · UE 2016/679

Right to compensation and liability

1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

2. Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

3. A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.

4. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.

5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.

6. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the Article 82 compensation action falls within the ordinary civil courts (tribunal d'arrondissement), not the CNPD, which only issues corrective measures and administrative fines. The law of 1 August 2018 organising the CNPD confirms this duality: the compensation route is strictly judicial and follows the Article 79(2) forum, either the defendant's place of establishment or the data subject's Luxembourg residence.

Luxgap practice: build your evidentiary file in advance, because before the Luxembourg judge the paragraph 3 burden of exemption rests entirely on the defendant; our time-stamped snapshots serve directly as substantive exhibits.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 82 opens the door to private civil litigation, distinct from CNPD administrative fines. The trap: many organisations believe a mere infringement is enough to trigger damages, whereas the CJEU (judgment Osterreichische Post, C-300/21, public fact) requires three cumulative conditions: an infringement of the GDPR, actual damage (material OR non-material) and a causal link. Conversely, controllers underestimate the joint and several liability of paragraph 4: when several actors are involved in the same processing, each can be ordered to pay the entire damage, then left to seek recovery from the others.

The concrete levers of defence and exposure

Non-material damage is compensable without a threshold of seriousness (CJEU), but the claimant must prove it concretely: loss of control over data is not automatically sufficient.
The paragraph 3 exemption requires proving that the triggering event is not in any way attributable to you: a heavy burden of proof resting on your documentation.
A processor is liable only if it breached an obligation of its own or acted outside instructions: your Article 28 DPAs and instruction logs become defence exhibits.
Joint and several liability (para. 4) turns a defaulting vendor into a direct financial risk: without documented recovery rights, you pay for the others.
Jurisdiction follows Article 79(2): the court of the establishment OR of the data subject's residence, which multiplies the possible forums.

In practice, what wins or loses an Article 82 case is evidentiary traceability: who did what, on whose instruction, with which security measure in place at the time of the events.

How Luxgap automates this risk

Our Luxgap Liability Evidence Vault turns your Article 82 defence from a panic reconstruction exercise into a pre-built, time-stamped and enforceable evidentiary file. The tool continuously captures your compliance evidence (documented instructions, active security measures, chain of responsibility) and cryptographically seals it, so that when a civil action arrives you can immediately demonstrate that the triggering event is not in any way attributable to you within the meaning of paragraph 3.

Captures in real time the documented instructions sent to your processors via M365, Odoo and your contracting platforms, to evidence that each party acted within its scope.
Automatically reconstructs the map of actors involved in each processing operation (joint controllers, processors, sub-processors) to anticipate the joint and several liability of paragraph 4.
Generates pre-drafted recovery clauses by relationship type, so you can claim back the share of the other actors under paragraph 5.
Seals a time-stamped snapshot of the security posture (Defender, Sentinel measures, access logs) at the moment of any incident, as exoneration evidence.
Calculates a financial exposure score per processing activity, cross-referencing the number of data subjects, data sensitivity and the documented solvency of your processors.
Produces a time-stamped PDF defence file structured along the CJEU grid (infringement, damage, causation), ready to hand to your counsel or the competent court.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams prepare a demonstration on your real perimeter, with a free blind audit within 48h to measure your exposure to civil litigation before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Right to compensation and liability

They trust us

Before we chat