Personal Data Breaches: When Does The GDPR Entitle Individuals To Compensation?

In guidance published on 2 October 2026, the French Data Protection Authority (CNIL) clarifies an important point: a personal data breach does not automatically entitle affected individuals to compensation.

Under Article 82 GDPR, three cumulative conditions must be met:

• An infringement of the GDPR. This may include a failure to implement appropriate technical and organisational security measures. Both controllers and processors have security obligations under the GDPR.
• Actual damage. This may be material or non-material, including financial loss, identity theft, reputational harm, loss of confidentiality or control over personal data, or fear and anxiety associated with the risk of misuse. No minimum threshold of seriousness applies to non-material damage, but the damage must be real and personally suffered.