Personal Data Breaches: When Does the GDPR Entitle Individuals to Compensation?

In guidance published on 2 October 2026, the French Data Protection Authority (CNIL) clarifies an important point: a personal data breach does not automatically entitle affected individuals to compensation.

Under Article 82 GDPR, three cumulative conditions must be met:

• An infringement of the GDPR. This may include a failure to implement appropriate technical and organisational security measures. Both controllers and processors have security obligations under the GDPR.
• Actual damage. This may be material or non-material, including financial loss, identity theft, reputational harm, loss of confidentiality or control over personal data, or fear and anxiety associated with the risk of misuse. No minimum threshold of seriousness applies to non-material damage, but the damage must be real and personally suffered.
• A causal link. The damage must result from the GDPR infringement. The mere fact that damage occurred in the context of a data breach is not sufficient.

The CNIL also recommends preserving evidence of the incident and its consequences, including notifications, emails, screenshots, complaints and proof of expenses.

Who can award compensation? Not the CNIL. It can investigate complaints and impose corrective measures or administrative sanctions, but compensation must be sought before the competent court.

In France, compensation claims generally fall within the jurisdiction of the tribunal judiciaire where private entities are concerned, or the tribunal administratif where the liability of a public authority is at issue. Depending on the circumstances, individuals may also be represented by an eligible non-profit organisation or seek redress through a group action, under a framework recently reformed by the French Law of 30 April 2025.

Key takeaway for businesses: a data breach does not automatically establish a right to compensation. Compliance with security obligations, the existence of actual damage and the causal link between the infringement and that damage all matter.