5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Defend against GDPR damages claims
The line of defence must be in place before you respond.
We assess claims under Art. 82 GDPR from a legal, technical and procedural perspective: we check the requirements, secure the facts, challenge damage and causation and assess settlement risks. Defend against unjustified GDPR damages claims: we set the line of defence before the first response.
Please enter a short description first.
The first contact is free of charge. If any costs arise, we will tell you explicitly in advance.
Response on working days within 24 hours
Stand: 23.10.2026
Damages under Art. 82 GDPR
As a result of the data breach, our client has lost control over his data.Loss of control proven?
We demand appropriate compensation for non-material damage.Damage set out?
The cause lies solely in your inadequate protective measures.Check causation
Point of attack: an infringement does not replace damage that has been set out
- 1Secure the claimDeadlines and documents
- 2Challenge the claimInfringement, damage, causation
- 3Steer the responseReply, settlement, lawsuit
Schematic illustration of a claim letter. Simplified example.
We defend against claims arising from
- Data breaches
- Disputes over access requests
- Employee data
- Serial claims
What should you do first?
- Note the date of receipt and the deadline of the claim or the date the lawsuit was served.
- Secure logs, tickets, emails and information from service providers about the incident.
- Do not respond with an apology that looks like an acknowledgement while the facts are still open.
Key points in brief
- Art. 82 GDPR is not an automatic payment for every data protection infringement.
- The claim requires an infringement, material or non-material damage and causation between the two.
- According to the case law of the German Federal Court of Justice (BGH), a proven loss of control can already constitute non-material damage.
- At ITMR we secure the facts, challenge the claim and steer the reply, settlement or defence against a lawsuit, including where there are several claimants.
- Your contact is Dominik Skornia and his team. He is an AI-Privacy-Expert (GDDcert. EU). Response on working days within 24 hours.
- GDPR
- The EU General Data Protection Regulation. It governs how companies may process personal data.
- DPA
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on behalf of a controller.
- SaaS
- Software as a Service. Software that is used over the internet rather than installed.
Acute situation
What tips a damages case in practice?
In our experience, a case rarely tips on a single provision. It becomes critical when the claim, the factual picture, the IT review, data protection communication and litigation strategy do not fit together.
The claim should neither be paid reflexively nor disputed across the board.
A claim under Art. 82 GDPR does not belong in a standard letter. What matters is whether the alleged infringement, the damage claimed and causation actually fit together.
For companies, more is at stake than the amount in the individual case. An imprecise reply can make later lawsuits harder to defend, encourage further claimants, strain communication with the supervisory authority or expose gaps in documentation.
If the data protection issue turns into a dispute with an authority or a court, we continue the mandate in the area of privacy litigation.
- For whom
- Companies facing a claim or lawsuit under Art. 82 GDPR
- Provision
- Art. 82 GDPR
- Requirements
- Infringement, damage, causation
- Leading decision
- Federal Court of Justice (BGH), Karlsruhe, VI ZR 10/24
Keep the deadline in view
Upload the claim in the form. We will get back to you on working days within 24 hours with an initial assessment and the next step.
How it works
How do we defend you against the claim?
We work in three steps and set the pace according to the deadline.
01
Secure the claim
We record the claim letter, lawsuit, incident, previous communication, data concerned and running deadlines in an orderly way.
02
Challenge the claim
We separately review infringement, damage, causation, loss of control, responsibility, documentation and evidential risks.
03
Steer the response
We bring rejection, settlement, statement of defence, strategy for serial cases and internal follow-up documentation into a consistent line.
Defence on three levels
- 1
Claim level
We review infringement, damage and causation separately. A data protection error does not replace setting out compensable damage.
- 2
Factual level
We bring tickets, logs, emails, access request documents, technical measures, DPAs, risk assessments and communication into a robust chronology.
- 3
Procedural level
Rejection, settlement, defence against a lawsuit or a model defence depend on whether the individual case remains isolated or has a wider impact.
How long does it take? We complete most work steps within a few working days. How fast it goes depends on the scope and on your feedback. Do you have a fixed date, such as a deadline? Tell us right away in your enquiry and we will plan for it.
Service package
What is available after our review?
Service package: GDPR damages
Strength of the claim
Assessment of whether infringement, damage and causation are set out conclusively and where the claim can be challenged.
Line of evidence
An orderly basis of facts and documentation with chronology, system references, communication status and evidence.
Response strategy
Decision paper for rejection, settlement, partial settlement, statement of defence or managing serial cases.
Out-of-court reply
Draft reply to data subjects or their lawyer, coordinated with the authority, insurer and customers.
- For whom
- Controllers and processors
- First response
- on working days within 24 hours
- Costs
- We tell you the costs transparently before you instruct us.
- Not included in the package
- Defence against lawsuits in court and proceedings before authorities. These are separate services, on request.
Who provides what and who decides
What you provide
- Claim or lawsuit with deadline
- Chronology of the incident
- Logs, tickets, contracts
- Previous replies
What we take care of
- Review of the claim
- Line of evidence
- Draft reply
- Settlement assessment
Who decides
- Your company, on payment or settlement
- In a dispute, the court
How does the engagement work?
- 1
Initial assessment
You send the claim or lawsuit via the form. We tell you the deadline and the immediate need for action. The first contact is free of charge.
- 2
Offer
Before work begins, we tell you the scope and costs transparently.
- 3
Court action separately
We agree court proceedings and representation before a court or supervisory authority separately, if you wish.
Tipping points
Where is the case decided?
We review these three points first.
Loss of control is alleged
Which data were affected, is a loss of control comprehensible, and are damage and causation set out specifically?
The first reply shapes the case
Replies to data subjects, the authority, insurers, service providers or customers can narrow the room for defence. Contradictions cost substance.
A single case can spread
Several claimants, uniform letters or templates from legal tech providers call for a line that also takes follow-on claims into account.
Case groups
In which situations do companies need to act?
We encounter these six case groups in our defence work.
Data breach with a claim
After misdirected mail, ransomware, an open cloud link, a hijacked account or an incident at a service provider, access requests, damages claims and questions about notification follow.
Access requests and Art. 82 GDPR
An access request escalates because its deadline, scope or completeness becomes disputed, and monetary compensation is then demanded.
Employee data
Personnel data, salaries, applicant data, internal investigations or access rights combine employment conflicts with damages claims.
Direct marketing and objection
Objections to advertising, newsletters, address lists or CRM processes trigger claims when data subjects allege a loss of control.
Platforms, SaaS and online retail
Customer accounts, orders, profiles, tickets and interfaces create mass exposure when one process affects many people.
Serial claims or lawsuits
Uniform letters or several lawsuits call for a coordinated strategy for argumentation, settlement and litigation.
Defence work
What exactly do we review in the defence?
For each review point, we look for the approach that works in the specific case.
| Review point | Question | Typical approach |
|---|---|---|
| GDPR infringement | Is the breach of duty proven, or are data protection, IT errors and dissatisfaction being mixed up? | Legal basis, roles, process, measures, DPA |
| Damage | Is material or non-material damage specifically alleged and made comprehensible? | Substantiation, loss of control, distinction from mere annoyance |
| Causation | Was the damage caused by the specific infringement? | Chronology, own conduct, third-party causes |
| Responsibility | Who is the controller, processor or joint controller? | Contracts, instructions, subcontractors |
| Communication | Do the reply to the data subject, notification to the authority and pleadings fit together? | Consistent line, approvals, agreed wording |
| Economic solution | Is disputing, settlement, partial payment or a model defence more sensible? | Costs, follow-on claims, insurers, reputation |
Serial risk
What applies when a claim becomes a pattern?
The economic risk can exceed the individual claim. Then it also matters whether the defence can be repeated.
Our line for serial cases
- Replies that also hold up in follow-on cases
- Settlements without signalling to further claimants
- Consistent internal approval of the facts
- Model line with room for individual cases
- Court, insurer and supervisory authority aligned
Clarify immediately
- Which deadline is running, who has already replied?
- Which data, systems and service providers are affected?
- Is specific damage alleged or only an infringement?
- Are the press, the authority or further claims looming?
- Which evidence has already been documented?
Defence risk
Which mistakes make claims unnecessarily strong?
A good defence works early with a robust chronology, separate requirements for the claim and clear responsibilities.
What is risky
- Blanket rejection without work on the facts
- An apology that sounds like an acknowledgement
- Inconsistent information from IT, HR and sales
- Logs and tickets secured too late
- Settlement without considering copycats
- No consistent line for the supervisory authority and the court
What helps
- Separate infringement, damage and causation
- A robust chronology of events
- Evidence of protective measures and roles
- Consistent external communication
Classification
When is another service package a better fit?
Depending on the situation, we guide you to the right page.
Help with a data breach
If the incident is still acute and notification, communication to data subjects or a risk assessment under Art. 33 and 34 GDPR is pending.
Privacy litigation
If, besides damages, fines, supervisory measures, injunctions or litigation are in the foreground.
Data protection law
For compliance, data subject rights, roles, processes, contracts and preventive advice.
Case law
What does case law say about Art. 82 GDPR?
Under Art. 82(1) GDPR, any person who has suffered material or non-material damage as a result of an infringement of the GDPR is entitled to compensation. In judgment C-300/21, the Court of Justice of the European Union clarified that a mere infringement is not sufficient.
According to the same decision, there is no threshold of seriousness for the damage. However, the claimant must show that damage has occurred.
On 18 November 2024, the German Federal Court of Justice (BGH) ruled that even a brief loss of control over one’s own data can constitute non-material damage (VI ZR 10/24). Merely arguing that nothing happened therefore falls short.
Under Art. 82(3) GDPR, the controller is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.
Sources
- General Data Protection Regulation (EUR-Lex) Art. 82 GDPR on liability and the right to compensation.
- BGH, judgment of 18.11.2024, VI ZR 10/24 Loss of control, burden of presentation and non-material damage.
- CJEU, judgment of 4.5.2023, C-300/21 An infringement alone does not justify a claim; no threshold of seriousness.
Limits
Where are the limits of the defence?
We tell you openly when disputing the claim has little prospect of success.
- 1
Loss of control must be taken seriously
If a loss of control is proven, pointing to the absence of misuse is not enough. We then review the amount, causation and settlement.
- 2
No outcome promised
How a court decides depends on facts and evidence. We assess the risk but do not promise an outcome.
- 3
Organisation remains an issue
The defence depends on processes, documentation and protective measures. Gaps there can only be closed to a limited extent in the proceedings.
Mistakes we see in practice
- The deadline is missed because the letter sits around internally.
- Several departments reply with different information.
- The settlement is concluded without considering follow-on cases.
Your contact
Dominik Skornia, LL.B.
Rechtsanwalt (lawyer) · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title Fachanwalt für Informationstechnologierecht (certified specialist lawyer for IT law).
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Ms Kürsch advised us very competently on legal questions relating to Meta. Her advice was consistently friendly, clearly structured and professionally convincing. She explained complex matters in an understandable way and always gave us the feeling of being in good hands.” (translated from German)
“Top team of lawyers – clear recommendation!” (translated from German)
“I am very satisfied with the support from ITMR Rechtsanwälte. Communication was exceptionally fast, straightforward and reliable from the start. I particularly appreciated that no unrealistic promises were made. Instead, the possible outcome of the proceedings was assessed clearly and honestly, so I always knew where I stood. Fortunately, the matter has now actually taken a turn for the better and the lawsuit was withdrawn.” (translated from German)
FAQ
What questions do companies ask about Art. 82 GDPR?
Is a GDPR infringement automatically enough for damages?
No. There must be an infringement, material or non-material damage and causation. The infringement alone does not replace setting out compensable damage.
We summarise the most important CJEU decisions on Art. 82 GDPR in our article (in German) Claims for damages under Art. 82 GDPR: overview.
Can a loss of control already be damage?
Yes, a proven loss of control can be non-material damage. We check whether it has been set out in the specific case and is linked to the alleged infringement.
What should we do if a lawsuit has already been served?
Organise deadlines, service, the claim, the facts, evidence and previous communication without delay. The statement of defence must fit the data protection, IT and communication situation.
How do we respond to serial claims?
With a model line and review of each individual case. We ensure consistent facts, coordinated reply modules, settlement criteria and clear external approvals.
Should we settle right away?
Not without a risk review. A settlement can make economic sense, but it can also encourage copycats or create contradictions.
Which documents do you need?
Claim letters, deadlines, previous replies, a chronology of the incident, logs, tickets, technical measures, DPAs, access request documents, communication with authorities and internal approvals.
Is it only about money or also about organisation?
The two are connected. The claim concerns money, but the defence depends on processes, documentation, roles, protective measures and communication.
When should we involve a lawyer?
As soon as there is a specific claim, lawsuit, deadline, data breach with follow-on risk or several similar letters. Organising the facts early prevents avoidable mistakes.
Next step
Have you received a claim under Art. 82 GDPR?
Whether rejection, settlement or statement of defence: the first response should be based on a clarified factual picture. We review how strong the claim is and which strategy makes sense.
Helpful for your enquiry
- Claim letter or lawsuit
- Deadline
- Previous replies
- Short chronology
You can also send documents after our first response.
Have the damages claim assessed
Upload the claim or lawsuit. We assess the claim and the next step.
Helpful items are the claim letter or lawsuit, deadlines, previous replies and a short chronology of the incident.
Related services
Privacy litigation GDPR lawsuits, fine proceedings and proceedings before authorities.Help with a data breach If the incident is still acute.Data protection access requests If the claim starts with an access request.Help with the supervisory authority If the authority is writing to you at the same time.Data protection law Compliance, roles and processes.
From our blog (in German): Claims for damages under Art. 82 GDPR: overview · Tracking without consent · An apology as compensation