Managing director liability for data protection infringements

Limitation of liability and its limits

A GmbH (limited liability company) or AG (public limited company) is intended to limit the personal liability of its management — that is one of its central purposes. In data protection, however, this shield does not apply without restriction. Under § 43 GmbHG (Limited Liability Companies Act) or § 93 AktG (Stock Corporation Act), management is liable to its own company if it breaches its organisational duties — and these now expressly include the duty to ensure a functioning data protection compliance system. The risk is heightened by a recent clarification from the highest court: the BGH (Federal Court of Justice) has ruled that even a brief loss of control over personal data can give rise to non-material damage under Art. 82 GDPR — without the need for actual misuse of the data or a materiality threshold (BGH, judgment of 18.11.2024 – VI ZR 10/24, following CJEU, judgment of 4.5.2023 – C-300/21). Even an infringement perceived as minor — such as a formal error in an application process or a delayed erasure — can give rise to a claim if damage results from it. The bar for an “insignificant” data protection problem is therefore lower than many companies assume.

When the risk becomes personal

When does a corporate risk become a personal one? The decisive factor is management's substantive involvement in the infringement. This does not require personal access to the data. It is sufficient if management benefits from the unlawful processing, ordered it or knowingly tolerates it, although it could and should have intervened. Anyone who knows of a data protection breach and nevertheless does nothing — for example for cost reasons or because a project would otherwise miss its schedule — is thus moving into the area of personal liability, irrespective of who processed the data technically.

NIS-2 tightens the situation

The situation has been further tightened by the NIS-2 Directive, which has applied in Germany since 6 December 2025. For companies covered as “important” or “essential” entities, NIS-2 expressly and personally lays down management's responsibility for cybersecurity risk management — with separate training obligations for management itself, not just for the IT department. For a growing number of companies, data protection and information security obligations thus no longer run separately but are interlinked — and in terms of liability, both increasingly end up on the same desk.

What this means in practice

In practice, this means: delegation to the data protection officer or IT only protects if it is genuine — with clear responsibilities, documented decisions and actual supervision, not just on paper. An existing D&O insurance policy should be checked as to whether data protection infringements are covered; many policies expressly exclude fines. And for structural decisions — new software, new data flows, use of AI — early legal advice is more worthwhile than a later defence once the infringement has already occurred.