Data Breach Compensation: Find Out What Was Taken First

Not always. The legal test is whether the breach is “likely to result in a high risk to the rights and freedoms of natural persons”. If it is, the organisation must tell you “without undue delay”. The ICO puts it in plain terms:

“If a breach is likely to put you at risk, an organisation must inform you directly and as soon as reasonably possible. For example, if it could affect your wellbeing, finances, ability to work or put you at risk of harm.”

There are three exceptions in the law. The data was protected in a way that makes it unreadable, such as encryption. The organisation has since taken steps that mean the high risk is no longer likely. Or contacting everyone would take disproportionate effort, in which case it must make a public announcement instead. That last one is why some people learn about a breach from the news rather than from a letter.

Whether or not it tells you, the organisation must keep a record of every breach — what happened, its effects and what it did about it — so the information you are asking about exists.

The ICO’s own guide, how will I know if I’ve been affected, covers this from the reader’s side.

Under Article 15 of the UK GDPR, you are entitled to confirmation of whether the organisation holds your data, a copy of it, and alongside the copy:

• The categories of personal data it holds about you — the quickest way to see what a breach of its systems could have reached.
• The recipients it has disclosed your data to. The ICO tells organisations to give the identities of specific recipients, and only fall back to categories where naming them would be impossible or manifestly unfounded or excessive.
• The source of anything it did not collect from you directly.

What it will not necessarily get you. The law does not say whether people who accessed data without permission count as “recipients”, and the ICO’s guidance on the right of access does not deal with breaches at all. So do not expect a subject access request to make an organisation name the attackers, or to describe the incident. Ask the question anyway; just do not treat silence on it as a breach of the deadline.

- Whether any of my personal data was involved in the incident you announced on [date], and if so which data
- The recipients my personal data has been disclosed to, including any disclosure in that incident
- My data protection complaint about that incident: please acknowledge it and tell me what happened to my information

Time limit. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Identity. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

What a search has to cover. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

You have a legal right to compensation if you have suffered damage because an organisation broke data protection law. Article 82 of the UK GDPR covers “material or non-material damage”, and section 168 of the Data Protection Act 2018 says non-material damage “includes distress”.

Three things that are less often said:

• A breach is not automatically a claim. The organisation escapes liability if it proves it is “not in any way responsible for the event giving rise to the damage” (Article 82(3)), and you have to show damage. The ICO notes that if you fail to show you suffered damage or distress, “the court will not award you compensation and could order you to pay the other party’s costs”.
• The ICO cannot award compensation. In its own words: “We can’t award compensation or provide advice on making a claim”. A complaint to the regulator is not a route to money.
• You do not have to go to court. “If you think you may be entitled to compensation you can ask the organisation directly. If they agree, they may make a payment without you needing to make a claim through the court.”

How much a court would award is “up to the judge hearing the case”, and we do not estimate it. The ICO “strongly recommend[s] you take independent legal advice about the strength of your case before taking any claim to court”, and so do we. Its page can I take legal action against the organisation? is the place to start.

Whatever you decide, the copy of your own data is the evidence of what was held about you, and it is yours to ask for without anyone else’s help.

Courts in England and Wales expect you to write to the other side before you sue. The Practice Direction on Pre-Action Conduct describes the claimant “writing to the defendant with concise details of the claim. The letter should include the basis on which the claim is made, a summary of the facts, what the claimant wants from the defendant, and if money, how the amount is calculated”, and the defendant replying within a reasonable time — “14 days in a straightforward case and no more than 3 months in a very complex one”.

Some data protection claims fall under a specific court protocol with its own rules for what the letter must contain, so check which applies to yours. And time limits apply to starting court proceedings: the Practice Direction says in terms that it “do[es] not alter the statutory time limits”. Take advice early rather than late.

Complaining. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the ICO, the UK's data protection regulator.

For these incidents we have worked out who holds your data and where the request should go — which is not always the company in the headline.

• Capita (March 2023)Pension scheme members ask their scheme, not Capita. Staff ask Capita plc.→
• Southern Water (2024)What was taken was never published. Where to ask, and what the ICO decided.→
• Legal Aid Agency (2025)Records back to 1978. Requests go to the Ministry of Justice.→

Not listed? The steps above work for any organisation. Find its address in our directory, or use the letter builder and send it yourself.

If the copy looks thin, or the organisation answers the breach question and not the request, check what you got back against what you are entitled to. What a subject access request is covers the rest of the mechanics.