Abstract: The CJEU ruled that the fear of a data subject over the possible misuse of their data from a data breach counts as a non-material damage and can lead to financial compensation from the controller.

The burden of proof is on the controller to prove that appropriate measures were adopted against the cyberattack.