Your rights after a data breach and how to claim compensation

# What counts as a data breach A data breach happens when protected personal information is lost, destroyed, altered, disclosed, or accessed without permission. Typical examples are hacked systems, leaked contact details, or accidental exposure by an organisation. Names, phone numbers, emails and other personal identifiers are often affected.

# Your legal protection In the UK the Data Protection Act 2018 (the domestic implementation of GDPR) requires organisations to keep personal data secure. That duty includes steps to prevent unauthorised processing and to protect against accidental loss, destruction, or damage.

# First practical step: contact the organisation Always begin by contacting the organisation you believe is responsible (the data controller). Tell them clearly:

• the distress or psychological impact you experienced.

# When to involve the Information Commissioner's Office (ICO) If the organisation's response is unsatisfactory, complain to the ICO. The ICO can investigate and form an opinion about whether the GDPR was breached. The ICO cannot award compensation, but its finding that the law was breached is useful evidence if you later pursue a court claim.

# Taking a claim to court If negotiation and the ICO route do not resolve the matter, individuals can bring a claim in the small claims court. The ICO's confirmation that GDPR was breached strengthens your case, but you will still need to show the extent of your losses or the distress caused.

# Evidence to collect Gather and preserve evidence before you escalate a claim. Concrete items include:

• Screenshots of breach notifications or public announcements.
• Records of financial losses: bank statements, invoices, receipts for costs directly caused by the breach.
• Personal logs of distress: dates and descriptions of sleep loss, anxiety, need for counselling, or other psychological effects.

Keep originals and create dated digital copies. A clear, organised file will make it simpler to present a claim or to show the small claims court.

# Practical tips If you believe fraud or identity theft followed the breach, act quickly to protect your accounts and report the fraud to banks and credit agencies. When negotiating with the organisation, be specific about the remedy you want (repayment, reimbursement, or a set compensation sum) and back it with evidence.

# Summary You have a route to compensation if an organisation's loss or mishandling of your personal data causes financial harm or distress. Start by contacting the organisation, collect detailed evidence, complain to the ICO if needed, and use the ICO's findings to support a small claims court action if negotiation fails.