High Court - 2026 IEHC 640
High Court rules controller must prove GDPR compliance once engaged.
The Irish High Court has ruled on the burden of proof in GDPR infringement cases. While not creating a general reversal, the court determined that once a claimant establishes the defendant is a controller and GDPR obligations are engaged, the controller must then prove its compliance. This ruling clarifies pleading requirements and access to information in representative actions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Irish High Court has established that once a claimant demonstrates a defendant is acting as a data controller with GDPR obligations engaged, the burden shifts to the controller to affirmatively prove its own compliance. This ruling has significant implications for organisations across the EU/EEA, as it means controllers can no longer rely on claimants to fully prove non-compliance — they must be able to demonstrate lawful processing proactively. This mirrors the accountability principle already embedded in GDPR Article 5(2), but now carries sharper litigation risk. Organisations that lack documented compliance evidence are especially vulnerable to representative actions and regulatory scrutiny. The ruling underscores that GDPR compliance must be continuous, documented, and readily demonstrable — not merely assumed.