When a Company Has a Data Breach

Under Article 34 of UK GDPR, an organisation must notify you directly if a breach is "likely to result in a high risk to your rights and freedoms." This includes situations where the breach could lead to:

• Identity theft or fraud
• Financial loss
• Damage to reputation
• Discrimination or social disadvantage
• Loss of confidentiality of sensitive data (health, financial, or criminal records)

Notification to you personally is separate from the organisation's obligation to report the breach to the ICO within 72 hours. A breach that does not present a high risk to you may still need to be reported to the ICO but does not require individual notification.

The notification to you must include: what happened, what data was involved, the likely consequences, the measures taken or proposed, and the contact details of the DPO.

If you believe an organisation has suffered a breach involving your data and has failed to notify you (or the ICO) as required, you can:

1. Contact the organisation directly to ask about the breach and what steps they have taken. Request information about what data was affected.
2. Make a SAR to understand what data of yours the organisation holds and whether their records show the data was involved in a breach.
3. Report to the ICO at ico.org.uk/make-a-complaint. The ICO can investigate whether the organisation met its breach notification obligations and take enforcement action.

The ICO can impose significant fines on organisations that fail to report a breach (up to £8.7 million or 2% of global turnover) and can also investigate the underlying security failure.

If your personal data has been exposed in a breach, take immediate steps to reduce your risk:

• Change passwords for any accounts using the compromised email or password, and use unique, strong passwords for each account going forward.
• Enable two-factor authentication (2FA) on all important accounts (banking, email, social media).
• Monitor your bank and credit card statements for unauthorised transactions and report any fraud immediately to your bank.
• Place a CIFAS protective registration on your credit file (small annual fee) if your identity documents or financial details were compromised — this adds a flag to credit applications made in your name.
• Contact Action Fraud (0300 123 2040) if you become a victim of fraud linked to the breach.

Article 82 of UK GDPR gives individuals the right to claim compensation from an organisation for material damage (financial loss) or non-material damage (distress, anxiety, loss of dignity) caused by a breach. To succeed in a claim you must show:

1. The organisation infringed UK GDPR (e.g., failed to have adequate security measures, processed data without a lawful basis).
2. You suffered damage as a result of the infringement.
3. There is a causal link between the breach and your damage.

Many data breach compensation claims are small and can be pursued through the county court's small claims or fast-track procedure. For large-scale breaches affecting thousands of people, group litigation orders (GLOs) have been used. Specialist data protection solicitors often act on a conditional fee ("no win, no fee") basis for breach compensation claims.