The House of Data Imperiali bulletins are extracts from the articles of the Legal Information Service (SIG) edited by Mr. Rosario Imperiali d’Afflitto.

The SIG is available by subscription only.

For further information, please email:

Burden of proof in the exercise of privacy rights

The principle of accountability requires the controller to demonstrate its compliance with the requirements of the GDPR, establishing a general reversal of the burden of proof. This conclusion is especially true in controller-supervisory authority relationships and, to a lesser extent, in controller-data subject interactions. There are, in fact, situations in which the data subject cannot claim prerogatives granted to him or her by law, without substantiating his or her claims in any way.

In this circumstance, we will reread the provisions on the exercise of rights under this particular interpretation.

Accountability and burden of proof

The data controller bears the burden of proof on all disputes where the subject of the issue is compliance with the principles of data processing under Article 5(1) of the GDPR. Indeed, “in accordance with the principle of accountability set out in Article 5(2) of Regulation 2016/679, the data controller must be able to prove that it has complied with the principles applicable to the processing of personal data set out in paragraph 1 of that article” (CJEU, SS SIA v. Valsts, C-175/20, p. 77).


According to the jurisprudence of the European Court of Justice – to the extent that the relevant Union legal act does not contain any specific provisions – it is up to the national court to apply the rule of the burden of proof provided by the national legal system, as long as this does not undermine the effectiveness of the Union law and ensures compliance with the obligations arising from the Union law ( cf. European Court of Justice, judgments of 3/10/ 2013 – C-113/12 p. 61, 9/7/2020 – C-86/19 p. 44 and 21/12/2021 – C-124/20 p. 65; see also Opinion of the Advocate General of 20/6/2019 – C-212/18 p. 47).