CJEU: Evidence Obtained in Breach of the GDPR May Be Used in Court Where National Law Allows It

In its judgment of 18 June 2026 in case C-484/24 (NTH Haustechnik), the Court of Justice of the European Union (CJEU) confirmed that the General Data Protection Regulation (GDPR) does not impose an automatic ban on the use of evidence containing personal data that a party obtained unlawfully. The ruling matters in practice for employers and businesses that gather evidence for litigation, in particular in employment disputes.

Case C-484/24 – Evidence from an Employee’s Personal Account

A German company sued its former employee for damages for selling company property via eBay. The company obtained the transaction records by logging into the employee’s private account using her user ID and password. The Higher Labour Court of Lower Saxony (Landesarbeitsgericht Niedersachsen) asked the CJEU whether it could rely on such material, given that the data may have been collected in breach of the GDPR.

Admissibility of Evidence Obtained in Breach of the GDPR – The CJEU’s Position

First, the admissibility of evidence is governed by national law, not by the GDPR. The Regulation contains no general prohibition on a court taking into account evidence obtained in breach of the rights to privacy and data protection. Second, the court processes personal data on its own legal basis: Article 6(1)(c) GDPR in conjunction with national law, and that national law may also take the form of clear, precise and foreseeable case law. Third, Article 17(3)(e) GDPR (defence of legal claims) merely excludes the right to erasure and is not a standalone basis for processing. Fourth, the court remains bound by the data minimisation principle, in particular before adding material to the case file and before disclosing it to the parties or third parties.

CJEU Ruling on the GDPR – What Does It Mean for Employers and Companies?

The ruling matters primarily to employers conducting internal investigations, HR and compliance teams, and any business that relies on system logs, correspondence, transaction histories or monitoring data in disputes.

How can evidence be used in court without increasing GDPR risks?

The judgment does not legalise earlier breaches. Submitting evidence to a court does not remove liability for unlawful data collection: administrative fines (Article 83 GDPR) and compensation claims by data subjects (Article 82 GDPR) still apply.

Before filing evidence, companies should therefore establish a separate legal basis for collecting, retaining and transferring the data, limit the evidence to what is necessary to prove the relevant facts, and anonymise data of uninvolved third parties. We also recommend reviewing employee monitoring and data retention procedures.

Are you using personal data as evidence? Check for GDPR risks before submitting it to court

We support employers and technology companies in assessing the GDPR compliance of evidence and in data protection disputes. You can read more about data controllers’ obligations in our guide GDPR and Personal Data Breach Obligations in Poland.

If you plan to use personal data in a legal dispute, it is advisable to assess the risks before submitting the evidence to the court. Our attorneys can verify the legal basis for data processing, the scope of the information included in the evidence, and the need to anonymise or restrict it. Contact our team to assess the risks and prepare the evidence in accordance with GDPR requirements.