Data breach after the contract ends: company liable for its service provider

The case: deletion merely announced

Anyone who has customer data processed by an external service provider remains responsible for it, even after the contract ends. The Federal Court of Justice made this clear in its judgment of 11 November 2025 (VI ZR 396/24). A contract requiring deletion is not enough. The company must itself ensure that the deletion is actually carried out.

The claimant was the user of a music streaming service. The operator, based in France, used a processor, that is, a service provider that processes data only on behalf of and on the instructions of the company. The engagement ended on 1 December 2019. The day before, the service provider announced by email that it would delete the website and all data on it the following day. No confirmation followed, and the operator did not ask for one.

Employees of the service provider had moved the data into a test environment instead of deleting it. From there it fell into the wrong hands, either through hackers or through employees who passed it on without authorisation. From November 2022, unknown parties offered the 2019 data records for sale on the dark web. Only on 22 February 2023 did the service provider confirm the deletion in writing. In the claimant's case, the data concerned his name, gender, email address, language and registration date.

The lower courts saw no damage

The Regional Court of Dresden dismissed the claim, and the Higher Regional Court of Dresden dismissed the appeal. The Higher Regional Court nonetheless identified the breach of duty: the operator had culpably failed to monitor its service provider, because it had not requested express written confirmation of the deletion. Had it asked, the data would have been deleted.

Even so, the court found no damage. An email address, it held, is not a particularly sensitive piece of data. Everyone receives spam. According to haveibeenpwned.com, the claimant's address had already been hacked earlier anyway, and he had not even changed it afterwards. His concern about misuse was therefore unfounded.

The contract alone is not enough

The Federal Court of Justice confirmed the breach of duty and framed it as a principle. The company remains "master of the processing"; the service provider is its extended arm. Once the engagement ends, no data may remain there, apart from statutory retention obligations. A contract requiring deletion and proof of deletion is not sufficient for this. The company must itself do whatever the circumstances require to ensure that the deletion actually happens.

In this case that would not have been much. The contract obliged the service provider to return or delete the data together with all copies within 21 days of the end of the engagement. Full performance had to be confirmed in writing. The announcement that it would delete "the site and all data on the site" did not even cover all copies in substance, and the confirmation was missing entirely. The operator should have demanded it immediately after the 21 days expired. The enquiry in 2023 came more than three years too late. In the senate's view, the risk of unauthorised access does not begin only with the hacking attack, but as soon as data remains with the service provider after the engagement ends.

Hackers and service providers are no excuse

The obvious defence was that the service provider had acted in breach of contract and that third parties had done the hacking. The Federal Court of Justice did not accept this. A company is liable for its processor's breaches in any event, unless it can exonerate itself. Here there was also a breach of its own. The GDPR presumes the company's fault.

Anyone who has themselves breached it, even only through slight negligence, would have to show that this breach has nothing to do with the damage. That did not succeed here. The failure to monitor was a contributing cause of everything that followed.

The dark web listing is the damage

The provision on compensation, Art. 82 GDPR, requires three things: a breach, damage, and a connection between the two. The claimant sought compensation for non-material damage, that is, for a disadvantage that cannot be expressed in money. This includes the loss of control over one's own data. Even this mere loss of control can constitute damage. Here, the data was also offered for sale on the dark web and thus used abusively. At the latest at that point, the senate held, the damage arose. No additional "emotional" damage is required.

Whether the email address is sensitive, whether others also receive spam and whether the claimant changed his address are irrelevant to whether damage exists at all. In holding otherwise, the Higher Regional Court introduced a de minimis threshold that does not exist. Such circumstances only count when assessing the amount. Earlier data breaches do not help the company either, since each further exposure deepens the loss of control and increases the risk of misuse.

The senate considered the claimant's concern about spam and fraudulent emails to be justified. Anyone whose name and email address are up for sale on the dark web must expect such emails. The Higher Regional Court of Dresden will now decide again on the amount and on the application concerning future financial losses.

What companies should do now

The judgment affects every company that has customer, user or personnel data processed by a service provider. The data processing agreement is only the beginning. The most expensive mistake in this case was a missing calendar entry for the day after the deletion deadline expired. The decision points to concrete steps for the end of a contract:

• Exercise the choice expressly: return or deletion of the data.
• Monitor the contractual deadline and demand written confirmation immediately after it expires.
• An announcement is not a confirmation. The confirmation must cover complete deletion, including all copies, also in test environments and at sub-processors.
• If no confirmation arrives, follow up and press for performance using the means provided by the contract.
• Document the process. The burden of proving that the security measures were sufficient lies with the company.

Anyone who skips these steps is liable to each individual data subject, and the hurdles for claimants are low: identically worded passages in many statements of claim do not count against the individual claim, and the more obvious the misuse, the less the claimant has to set out about his concerns.