Your Personal Data Leaked or Misused? How to Claim Compensation for a Data Breach (UK)

You get the email nobody wants to receive: "We are writing to let you know about an incident affecting your personal data." A company has leaked, lost, or misused information about you — a database left exposed, an email with your details sent to the wrong person, records handed to someone who should never have seen them. The apology usually offers little more than a year of credit monitoring. What it rarely mentions is that, in the right circumstances, you may have a legal right to compensation — and that right can cover not just money you have lost, but the distress the breach caused you. Here is how it really works, and — just as importantly — where the limits are.

Where the Right to Compensation Comes From

The core right is in Article 82 of the UK GDPR, which says that anyone who has suffered material or non-material damage as a result of an infringement of the data protection rules has the right to compensation from the organisation responsible (the "controller", and in some cases the "processor"). Alongside it, section 168 of the Data Protection Act 2018 spells out that "non-material damage" includes distress. Together these are the foundation of every UK data-breach compensation claim.

In plain terms, there are two kinds of harm you can claim for:

• Material damage — actual financial loss. Money stolen after your details were exposed, the cost of dealing with fraud or identity theft, or other quantifiable out-of-pocket loss caused by the breach.
• Non-material damage — distress, anxiety, or loss of privacy. English courts have accepted since Vidal-Hall v Google (2015) that you can claim for distress even if you lost no money at all, and that principle is now written directly into the UK GDPR and the Data Protection Act.

The Catch: A Breach on Its Own Is Not Enough

This is the part the "you could be owed thousands" adverts skate over. The fact that an organisation broke the rules does not, by itself, entitle you to a payout. In the leading case Lloyd v Google (2021), the Supreme Court held that you cannot claim compensation for the mere "loss of control" of your data without showing that the breach caused you actual damage — real financial loss or genuine distress. You have to point to a specific harm the breach caused you, not just the fact that it happened.

Lloyd v Google also blocked a particular kind of US-style opt-out class action — one that tried to claim an identical, one-size-fits-all sum for millions of people without looking at how each person was actually affected. It did not ban group claims altogether, but it did mean that, in practice, each person's harm has to be looked at individually. The takeaway for you: to have a claim, be ready to explain concretely how the breach affected you — the worry it caused, the time you spent dealing with it, any fraud or financial loss that followed.

The Myth That Costs People Their Claim: The ICO Does Not Pay You

Many people report a breach to the Information Commissioner's Office (ICO) and then wait for a cheque that never comes. Here is the crucial distinction: the ICO is the regulator. It can investigate an organisation, order it to change its practices, and issue fines that go to the public purse — but it cannot award compensation to you. Only a court can order an organisation to pay you.

That does not make complaining to the ICO pointless — an ICO finding that an organisation breached the rules can be useful supporting evidence if you later go to court. But if compensation is what you want, the ICO is a step along the way, not the destination.

How a Data-Breach Claim Actually Works

The usual route is:

• Complain to the organisation first. Put it in writing: set out what happened, how it affected you, and that you are seeking compensation under Article 82 of the UK GDPR. Many claims are resolved at this stage without ever going near a court.
• Consider a complaint to the ICO in parallel — for the regulatory finding, not for a payout.
• If the organisation refuses, you can bring a claim in the County Court. Lower-value claims (under £10,000 in England & Wales) are usually dealt with on the small claims track, which is designed to be used without a solicitor and keeps your cost risk low.

Be wary of claims-management firms promising "£1,000s" and quoting an "average payout". There is no official tariff for data-breach distress — courts assess every case on its own facts, and many awards are modest. A firm that takes a large cut of a small award may leave you with very little.

How Long You Have to Claim

In England & Wales the general limit is six years under the Limitation Act 1980. In Scotland it is five years under the Prescription and Limitation (Scotland) Act 1973 (with a longer backstop). One nuance to be aware of: if your claim includes a recognised psychiatric injury, a shorter three-year personal-injury limit can apply to that part — so if the breach has genuinely affected your health, do not sit on it, and take advice promptly.

Putting It in Writing

Whichever route you take, it starts with a clear, firm letter to the organisation — one that identifies the breach, explains exactly how it affected you, refers to your right to compensation under Article 82 of the UK GDPR and the Data Protection Act 2018, and asks them to put things right. A letter that is specific about your harm is far more effective than a vague complaint, and it puts your claim formally on record.