Under paragraph 2 any controller involved in the processing is liable for damage caused by infringing processing, whereas a processor is liable only where it has not complied with obligations of the Regulation specifically directed to processors or where it has acted outside or contrary to the controller's lawful instructions. The processor's exposure is therefore narrower and tracks its role as defined in Article 4(8) and its duties under Article 28.

Yes, but only under the exemption in paragraph 3, which requires it to prove that it is not in any way responsible for the event giving rise to the damage. The wording places the burden of proof on the controller or processor and sets a demanding standard, since any degree of responsibility defeats the exemption.

Paragraph 4 makes each of them liable for the entire damage where they are responsible under paragraphs 2 and 3, in order to ensure effective compensation of the data subject. The one who pays full compensation may then, under paragraph 5, claim back from the others the part of the compensation corresponding to their share of responsibility.

Paragraph 6 refers to the courts competent under the law of the Member State referred to in Article 79(2). That provision allows proceedings before the courts of the Member State where the controller or processor has an establishment or, alternatively, where the data subject has his or her habitual residence, unless the defendant is a public authority of a Member State acting in the exercise of its public powers.