GDPR Processor Liability for a Personal Data Breach

A data breach does not only implicate the controller. Since the GDPR, the processor has become a directly exposed party, both in civil law and in terms of administrative penalties. Hosting provider, software publisher, managed IT services provider or call centre: each may be held liable where its own obligations have not been met. The question is therefore no longer whether the processor can be pursued, but under what conditions and to what extent. The answer combines three distinct lines of reasoning: compensation for the harm suffered by individuals, the risk of a fine imposed by the CNIL, and the contractual allocation of the burden between the controller and its provider. Confusing them leads to poor decisions when the incident occurs.

Every situation is different and depends on the terms of the data processing agreement as well as on the circumstances of the breach. The analysis below sets out the applicable framework, not advice tailored to a specific case.

The processor: a party directly liable under the GDPR

Article 82(1) of the GDPR is unambiguous: any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to receive compensation “from the controller or processor”. The processor is therefore not a mere order-taker relieved of all liability by the client.

This exposure is coupled with obligations of its own. Article 32 requires the controller and the processor to implement technical and organisational measures appropriate to the risk. Article 28(3) lists the commitments that the contract must place on the processor: act on documented instructions, ensure confidentiality, govern the use of sub-processors, assist the controller, protect the data. Failure to meet one of these obligations is precisely what opens the door to liability.

When is a GDPR processor liable for a data breach?

Failure to meet its own obligations

Article 82(2) lays down the rule: a processor is liable for the damage “only where it has not complied with obligations of this Regulation specifically directed to processors”. In other words, a security failure attributable to the provider, retention beyond the agreed term or unauthorised use of a sub-processor may give rise to its liability.

Acting outside the controller’s instructions

The same article covers a processor that “has acted outside or contrary to lawful instructions of the controller”. A provider that diverts data from their purpose, or that disregards a written instruction, steps outside the protection afforded by its status as a mere order-taker and incurs liability.

Conversely, Article 82(3) provides a ground for exemption: the party is exempt from liability “if it proves that it is not in any way responsible for the event giving rise to the damage”. The burden of proof lies with the party relying on it, which requires rigorous traceability of security measures and of the instructions received.

Compensation for harm: joint and several liability and right of recourse

Where several parties are involved in the same processing, Article 82(4) sets up joint and several liability: each is “held liable for the entire damage” in order to ensure effective compensation of the data subject. The injured person may therefore bring a claim against the controller, against the processor, or against both, for the whole of the harm suffered.

However, this joint and several liability only governs relations with the injured person. Between the parties, the one that has paid compensation may then claim back from the others in proportion to their share of responsibility. The outcome of this allocation depends on the contractual terms and on who was actually responsible for the failure; it must be analysed case by case.

Administrative penalties: a risk separate from compensation

Civil compensation is not the same as an administrative penalty. The CNIL may impose fines whose ceilings are set by Article 83: up to €10 million or 2% of total worldwide annual turnover for certain infringements (in particular of the obligations under Articles 28 and 32), and up to €20 million or 4% for infringements of the basic principles. The processor may be directly targeted for failing to meet its own obligations.

Where Article 83 of the GDPR is relied on, an administrative fine does not arise from strict liability. The Court of Justice of the European Union has made clear that such a fine requires the infringement to have been committed intentionally or negligently, in particular in the Deutsche Wohnen judgment of 5 December 2023 (Case C-807/21). This requirement does not remove the risk of a penalty, but it calls for a concrete analysis of the conduct of the controller or the processor, the measures taken and the documentation available.

These amounts are maximums. Any amount depends on the criteria in Article 83(2) (gravity, duration, measures taken, cooperation) and is a matter for the authority, then for the court if an appeal is brought. No “standard” fine can be announced in advance.

Data breach: contractual and operational steps to take

Managing an incident starts before it happens, in the contract. Article 33(2) requires the processor to notify the controller “without undue delay after becoming aware of a personal data breach”. This information is what enables the controller, where applicable, to meet the 72-hour deadline for notifying the CNIL (Article 33(1)) and to inform data subjects where there is a high risk (Article 34).

• Set out in the contract an internal alert channel and deadline for the processor, shorter than the controller’s statutory deadlines.
• Document security measures (Article 32) so that you can show, when the time comes, that you were not responsible.
• Map sub-processors and their safeguards.
• Provide for the terms of cooperation, evidence and allocation of investigation costs.

Points to watch

• Processor status is no shield: failure to meet one of its own obligations is enough to make it liable.
• A limitation of liability clause in the contract cannot be relied on against the data subject; it only applies between the parties.
• The boundary between controller, processor and joint controllers (Article 26) must be checked: a reclassification changes the liability regime.
• Proof of diligence rests on documentation: record of processing, security measures, log of instructions.

When should you consult a lawyer?

A lawyer’s assistance is useful to audit the allocation of liability before signing, to calibrate the security, notification and liability clauses of the data processing agreement, and to steer the response to an incident. In proceedings before the CNIL, the focus shifts to defence during an inspection or a penalty procedure. Further upstream, overall protection is a matter of GDPR compliance.

Each case deserves its own analysis: the solution depends on the facts, the drafting of the contract and the applicable case law.

What the law says

The processor’s liability is based on Article 82 of the GDPR. Paragraph 2 provides: “A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.” Any person who has suffered material or non-material damage may bring a claim directly against the processor (Article 82(1)).

These obligations specific to the processor are set out in Article 28 of the GDPR. Breaching them also exposes the processor to an administrative fine under Article 83.

Official sources

• Article 82 of the GDPR (Regulation (EU) 2016/679), right to compensation and liability: CNIL (in French)
• Article 28 of the GDPR, processor: CNIL (in French)

Every situation is different. To make a data processing agreement legally sound or to handle a data breach, our GDPR lawyers assist you.

For assistance: data processing agreement lawyer.

For complete legal management of an incident (risk assessment, notification, informing individuals), see our page personal data breach lawyer.