In Case C-200/23, the CJEU addressed liability under Article 82 GDPR and confirmed that a controller or processor can avoid liability only by proving it was not in any way responsible for the event causing the damage. This increases the importance of operational accountability. Data processing agreements, security schedules, sub-processor controls, and incident cooperation provisions must demonstrate real governance in practice, as liability analysis will focus on control and causation rather than contractual labels.