Can I claim compensation for a data breach?

Article 82 of UK GDPR gives you a right to compensation from an organisation for material damage — money you have actually lost — and non-material damage, meaning distress, anxiety and loss of dignity. It is a civil claim, and it is entirely separate from the regulator's role.

What you have to prove

1. That the organisation infringed UK GDPR — for example by failing to have adequate security measures, or processing your data with no lawful basis.
2. That you suffered damage.
3. That the damage was caused by the infringement.

The causal link is where most claims are won or lost, so document everything as it happens: fraudulent transactions and what they cost you, time spent putting things right, correspondence, and a contemporaneous note of the impact on you. Where special category data such as health records is involved, the position is stronger — such breaches more easily meet the "high risk" threshold that triggers individual notification, and awards for distress are typically higher.

How to bring the claim

Many breach claims are modest and can be run through the county court's small claims or fast track. Larger events are sometimes handled by group litigation orders, and specialist data protection solicitors often act on a conditional fee basis. You do not always need to litigate: writing to the organisation setting out the infringement, your loss and distress, and the sum you are seeking resolves a good number of claims, particularly where the ICO has already made findings against them.

On timing, the Limitation Act 1980 generally allows six years from the breach or from when you became aware of it for a civil claim in England and Wales, though a three-year period can apply to personal injury and distress claims — get advice early rather than assuming the longer figure.

Be clear about what the ICO can and cannot do. It can investigate, issue enforcement notices and fine an organisation up to £17.5 million or 4% of global turnover for the most serious infringements — but those fines go to the Consolidated Fund, not to you. What an ICO finding does is strengthen your own claim considerably, which is why reporting the breach at ico.org.uk is worth doing alongside, not instead of, a compensation claim.