Q&As

What is the emerging market position on liabilities (including caps and indemnities) between controllers and processors?

read titleRead full title
Published on LexisPSL on 30/07/2018

The following TMT Q&A provides comprehensive and up to date legal information covering:

  • What is the emerging market position on liabilities (including caps and indemnities) between controllers and processors?
  • Liability under the GDPR
  • Caps on the processor’s liability
  • Indemnities given by the processor
  • Liability of the controller to the processor
  • The importance of context

What is the emerging market position on liabilities (including caps and indemnities) between controllers and processors?

This Q&A considers the emerging market position on liabilities (including caps and indemnities) in respect of a processor’s and controller’s contractual liability for breach of data protection obligations in their contracts pursuant to the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR).

This answer is based on a range of analyses (referred to below) provided by contributors to Lexis®PSL and Lexis®Library setting out their experiences.

It should be noted that with no previous supervisory authority fines to benchmark against, and with a GDPR-related dispute not yet having reached the courts, the GDPR is still too new for a ‘standard position’ to have emerged.

Liability under the GDPR

Various sanction and enforcement mechanisms are available under the GDPR itself or as a result of the contracts it requires the parties to put in place.

Those most likely to be relevant in the context of an agreement between a processor and controller are:

  1. administrative fines for non-compliance (up to the greater of 4% of total global annual turnover or €20m)

  2. obligations to compensate data subjects for the damage caused by breach of the GDPR, and

  3. liabilities arising under contracts (such as contracts between the controller and a third party or between the controller and processor)

The parties (in particular the controller) may also be subject to other

Related documents:

Popular documents