This chapter analyses the rules on civil liability for unlawful processing of personal data contained in Article 82 of Regulation 2016/679/EU (the General Data Protection Regulation; GDPR), focusing in particular on the subjective scope of application of the rule, on the delimitation of the concept of unlawful processing, on the reconstruction of the criterion of imputation of liability and on the identification of compensable damages. The discussion highlights the importance of the case law of the EU Court of Justice on the subject, especially in the light of the comparison with the principles and categories of Italian law.