Data protection liability: Who is liable under the GDPR?

The GDPR, i.e. the General Data Protection Regulation, is a European law that regulates the protection of personal data. It determines who is responsible for the protection of this data and under which circumstances liability arises. According to the GDPR, the **data controller** is liable, i.e. the person or organization that processes the data and is responsible for its purpose. This can be a company, an individual or even an external service provider, provided that it processes the data on behalf of the controller. The data controller must ensure that all data protection regulations are complied with and is usually liable for damages caused by breaches.

Another term that is important in this context is the **data processor**. The data processor is the person or organization that processes the data on behalf of the data controller. The data processor is not directly responsible for the processing, but must nevertheless comply with the requirements of the GDPR. In some cases, the data processor may also be liable if it does not fulfil the obligations of the GDPR or carries out the processing without consent.

To limit or exclude liability, certain documented measures can help. This includes, for example, the establishment of **Data Protection Officer**, the preparation of **contracts for processing** with data processors, the implementation of **Data Protection assessments** and the documentation of all data protection-relevant processes. Such measures can reduce or even eliminate adhesion, provided they are carried out correctly and completely.

## What does this mean for your company? If you process personal data, you as a data controller are obliged to comply with the GDPR. This means that you must treat the data securely and transparently, respect the rights of those affected and hire a data protection officer if necessary. You are also obliged to document all data security measures in order to prove that you have complied with the requirements of the DSG TDSVO in the event of breaches or legal proceedings.

## How ISN/xynap supports this xynap’s **Infrastructure** and **AI** modules provide GDPR-compliant solutions and AI-enabled tools to help meet data protection requirements. These modules help automate data protection-relevant processes and ensure that the processing of data is carried out in accordance with the requirements of the GDPR.