GDPR compensation exposure now requires provable damage, but claimant risk is real. In Österreichische Post C-300/21, the CJEU held that GDPR infringement alone does not trigger compensation; claimants must demonstrate non-material damage and causation, and there is no minimum seriousness threshold. For SaaS providers, this directly informs liability caps, indemnities, and incident response documentation. Clear controller and processor allocations in DPAs and SOWs are essential.