Delayed GDPR access response: Does your company have to pay damages?
The case: Information was not provided until after the lawsuit was filed
What happens if your company misses the monthly deadline for a GDPR notification? Does the mere delay automatically lead to a claim for damages? The Amtsgericht (AG) Nürnberg ruled in a judgment that is likely to be a relief for many companies: No. A belated notification alone does not constitute a claim for damages under Art. 82 GDPR (AG Nürnberg, Judgment of 06.05.2025 – Case No.: 15 C 8539/24).
After receiving a promotional letter, a customer concluded a DSL contract that she later cancelled. She felt deceived and demanded information from the provider about her stored data in accordance with Article 15 of the GDPR. The company did not respond to this out-of-court request. Only when the customer filed a lawsuit to compel the information, the provider provided the requested information. The plaintiff subsequently demanded compensation for the resulting delay.
The court's decision: Delay is not the same as unlawful processing
The AG Nürnberg rejected the claim for damages. The judges made a crucial legal distinction that is of enormous importance for practice:
- Acknowledgment of the violation: The court made clear that the information was indeed delayed, thereby violating the duty to provide information under Article 15 of the GDPR.
- No basis for damages (Art. 82 GDPR): However, a claim for damages under Art. 82 GDPR requires that a person is liable for an processing that violates the GDPR has suffered damage. The mere injury of the duty to provide information However, according to the court, this is not in itself a „wrongful processing“ of the data.
- Missing presentation: The plaintiff had not demonstrated that her data even the processing was carried out unlawfully (e.g., without a legal basis or for unauthorized purposes). Your claim related solely to the delayed response. This was not sufficient for the court to award damages.
Implications for companies: An exemption for delays?
GDPR information & deadlines – What you need to know
Conclusion: Punctuality pays off, but panic at even minor delays is inappropriate.
The Nuremberg judgment brings a welcome distinction to the discussion about GDPR damages. It makes clear that not every formal error automatically leads to financial claims. Nevertheless, companies should not take this as an invitation to negligence. Timely and complete responses to requests for information remain the best strategy to avoid costly court proceedings, regulatory measures, and the loss of customer trust.
FAQ
Does a delayed GDPR notification automatically lead to a claim for damages?
Not automatically. According to this legal view, a plaintiff would have to demonstrate that the delay caused them specific additional damage, or that the underlying data processing was inherently unlawful.
How quickly must I respond to a GDPR inquiry?
The response must be provided „promptly“, but no later than one month after receipt of the application. In complex cases, the deadline can be extended by an additional two months, but the applicant must be informed of this.
What happens if I miss the deadline?
They risk a procedure before the relevant data protection authority, which can lead to orders or fines. Furthermore, the person concerned, as in this case, can sue for the granting of access to the information, which incurs litigation costs.
What is the difference between a breach of the duty to provide information and unlawful data processing?
The violation of the duty of information disclosure is a procedural error in the handling of data subjects’ rights. Illegal data processing is a material violation, e.g., the processing of data without a legal basis, for an improper purpose, or after a revocation.
How can I organize my disclosure processes efficiently and legally?
A clearly defined process is crucial. The experts from sofortdatenschutz.de help you to make your processes for processing affected requests GDPR-compliant.
