what people believe:
“if we get hacked, we automatically lose”
A breach proves nothing on its own. The controller still has to prove its measures were appropriate, so the outcome turns on your paperwork.
The belief above is a common one, stated here in our words.
what happened
The case came from a Bulgarian court, after a cyber attack on the country’s national tax agency. A person whose data was exposed asked for damages, and the court asked the Court of Justice how to judge such a claim.
basis Court of Justice, C-340/21
what the court said
how the Court set out the argument
- 1a breach happensby a third party's attack
- 2that alone proves nothingabout whether measures were appropriate
- 3the controller must provethat they were, in a damages claim
- 4judged against the riskof that specific processing
basis Court of Justice, C-340/21, operative part; GDPR Art. 5(2), 24(1), 32(1), 82(3)
An expert report is not always necessary and not always sufficient as proof. A controller cannot escape paying merely because the damage came from a third party’s attack, unless it proves it is in no way responsible.
basis Court of Justice, C-340/21, operative part; GDPR Art. 82(3)
why it matters at your size
Picture two companies breached the same way, one with a risk register, dated access reviews and a restore test, and one with a policy nobody read. The first has something to argue. This is why every page about the work on this site ends with evidence.
basis GDPR Art. 5(2), 24(1)
check it yourself
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Court of Justice of the EU, C-340/21, judgment of 14 December 2023
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Pull together what you could show today to prove your measures were appropriate on the day of a breach.