Data Breach Complaints

If you discover your personal data has been breached — whether through a notification from the organisation, a news report, or noticing suspicious activity on your accounts:

• If financial data was involved: Contact your bank or card provider immediately. Request replacement cards if your card details may have been compromised. Monitor your statements for any unauthorised transactions and report them to your bank at once.
• If login credentials were involved: Change your passwords on the affected service and any other services where you use the same password. Enable two-factor authentication where available.
• Check your credit file: Use a free credit checking service to see if any credit applications have been made in your name.
• Report fraud: If you believe you have been a victim of identity fraud resulting from the breach, report to Action Fraud (actionfraud.police.uk).

If you believe an organisation has breached your data rights — by failing to protect your data adequately, failing to notify you of a breach, or mishandling your data in any other way — you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

The ICO is the UK's data protection regulator. It can investigate organisations and issue enforcement notices, fines, or require specific action. However, the ICO cannot itself award you compensation — for compensation, you must pursue a civil claim.

Before complaining to the ICO, raise your concern directly with the organisation first. Give them a reasonable period to respond (usually around four weeks). If they do not respond satisfactorily, you can then escalate to the ICO.

Under Article 82 of UK GDPR, you have the right to claim compensation from an organisation that has breached your data rights if you have suffered damage as a result. Damage includes both material damage (financial loss) and non-material damage (distress, anxiety, loss of control over personal information).

To claim compensation:

• Write to the organisation's Data Protection Officer (DPO) setting out the breach, the damage you have suffered, and the compensation you are seeking
• If the organisation refuses, you can issue a civil claim in the County Court
• Some solicitors take data breach compensation claims on a no-win no-fee basis for larger breaches

Be wary of claims management companies advertising data breach compensation — they often charge high fees that reduce your net compensation significantly.