By Stephen Chambers. Last updated 25th September 2024. Has your personal data been leaked? Are you suffering the consequences of a data breach? Since the introduction of the EU directive the General Data Protection Regulation GDPR data subjects- those who supply personal information to organisations – have a lot more control over how their personal data is processed. However, the United Kingdom is no longer part of the EU so has recently updated the Data Protection Act 2018 and devised its own take of the GDPR. In this guide, we shall discuss when a data subject could be eligible to claim against a data controller for a breach of their data privacy.
Our guide aims to take a detailed look at data breach claims and how to sue someone who hasn’t kept your personal information safe. However, if you still have any questions after reading, our advisors can help you.
Our team is available 24/7 to provide you with free legal advice on GDPR data breaches. Additionally, they can connect you with a solicitor when you’re ready to start your claim.
For more information, call us on 0800 408 7827. Alternatively, please continue reading.
Select A Section
- Can I Sue For A GDPR Data Breach?
- What Could I Claim Compensation For After A GDPR Breach?
- Who Could I Sue For A Breach Of The GDPR?
- What Evidence Can Help Me Sue For A GDPR Data Breach?
- Accepting A Data Breach Settlement Offer
- Data Breach Claims – No Win No Fee Solicitors
- Get Free Data Breach Claims Advice
- Resources
Can I Sue For A GDPR Data Breach?
Personal data is any form of data that can be used (either independently or along with other data) to identify who you are.
The Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR) are the laws that are in place to protect personal data. Data controllers and data processors have the responsibility of adhering to these laws to make sure that personal data is safe while it is being stored, processed, and handled.
Data controllers, usually a company, decide why and how personal data should be processed. Data processors act on the data controller’s instruction to actually process the data. Data controllers can also be the data processors, or they may outsource this task to a third party.
If data controllers or processors do not adhere to the data protection laws, this is wrongful conduct. Some instances of wrongful conduct can lead to a personal data breach. In Article 4 of the UK GDPR, personal data breaches are defined as a security breach that causes the unlawful or accidental alteration, disclosure of, loss, unauthorised access to, or destruction of one’s personal data.
As such, you will need to prove the following criteria in order to make a data breach claim. This criteria can be found in Article 82 of the UK GDPR.
- The data controller or processor failed to adhere to the DPA 2018 and UK GDPR.
- Because of this, there was a personal data breach.
- You were affected either financially, emotionally, or both, due to the data breach.
Have a chat with our advisors today to find out whether you are eligible to sue a company for data breach compensation.
How can a data breach happen?
Data breaches can happen for many reasons. But what constitutes a GDPR data breach? Essentially, a personal data breach may mean your data is;
- Destroyed, lost or altered
- Disclosed, accessed, transmitted
All without your authorisation, whether by accident or on purpose and without a lawful basis.
This might include:
- Sending an email that contains personal information to the wrong email address.
- Throwing away documents that contain personal data in the general waste.
- Personal letters posted to the wrong address.
- Leaving a laptop that has personal files on, on a train and it not being password protected.
There are many other ways your data could have been breached. If any of the above has happened to you or any other example not listed, you might be able to claim compensation. See below for the types of damages you can claim.
Can I sue a company for a data breach?
We all have the right to have our personal data protected, stored and handled correctly. If you’ve been a victim of a data breach by a company, you could be awarded compensation. Compensation will cover financial losses and any psychological distress you’ve suffered. However, it is not enough just for a data breach to have affected you. You must be able to establish using valid evidence that the data controller failed in its role to protect your data otherwise a claim is unlikely.
What Could I Claim Compensation For After A GDPR Breach?
Following a UK GDPR breach, you may be interested in learning what harm you can be compensated for. As we stated earlier, if the compromise in your personal data caused financial or mental health harm, you might be compensated. Also, you can be compensated for both types of harm in the same claim, or one or the other.
When you sue for a GDPR data breach, your financial harm is referred to as ‘material damage’. For example, if you spent money on therapy to cope with harm to your mental health due to the data breach, this would be considered material damage. Another example would be relocation and/or personal security costs. To recover these losses, you can submit payslips, invoices and receipts as part of the data breach claims process.
Non-Material Damage
When suing an organisation for UK GDPR breach compensation, any mental injuries are referred to as ‘non-material damage’. To help value non-material damage, those responsible for providing a calculation for data breach compensation may refer to the compensation brackets published in the Judicial College Guidelines (JCG). The JCG provides guideline compensation amounts for various illnesses and injuries, including mental health damage.
Our table below looks at figures for mental injuries from the JCG. It also provides a figure in the top row that shows how you could be compensated for very serious damage to your mental health plus your financial harm in the same claim. This figure was not taken from the JCG. Also note that the table is only provided for guidance.
| Injury | Severity | Guideline compensation amount |
|---|---|---|
| Multiple serious types of harm with financial impacts | Serious | Up to £250,000+ |
| Psychiatric Damage | Severe (a) | £66,920 to £141,240 |
| Moderately severe (b) | £23,270 to £66,920 | |
| Moderate (c) | £7,150 to £23,270 | |
| Less severe (d) | £1,880 to £7,150 | |
| Post-traumatic stress disorder | Severe (a) | £73,050 to £122,850 |
| Moderately severe (b) | £28,250 to £73,050 | |
| Moderate (c) | £9,980 to £28,250 | |
| Less severe (d) | £4,820 to £9,980 |
If you would like to know how data breach compensation could be calculated or if you would like a free valuation, please speak with an advisor.
Who Could I Sue For A Breach Of The GDPR?
Essentially to hold a valid data breach claim for compensation you must be able to show that the data controller did not do enough to keep your data safe. For instance, they did not train their staff on data awareness and this caused your personal information to be exposed. Just because a data breach has occurred will not automatically mean you can make a claim.
Data controllers can do the following as ways of protecting personal data;
- Regular reviews of data protection policies
- Keeping software and equipment up to date with the latest security updates, including a solid firewall
- Data protection and safety training
- Encrypting and backing up data
Although they should ensure your data stays protected, liability isn’t always straightforward. For that reason, it’s important to have the correct evidence for any data breach claims.
What Evidence Can Help Me Sue For A GDPR Data Breach?
Like with any type of claim, evidence is key. The evidence you require can depend on what you’re claiming. For example, if you’re claiming for serious psychological damages, you may be invited for an assessment to get a psychological report. This medical evidence is important in building a valid GDPR data breach compensation claim.
Additionally, if you have reason to believe that your data has been breached, you can make a complaint to the Information Commissioner’s Office. They can advise whether a breach has occurred, and that can also be used as evidence.
If you have any questions on the evidence you can use to sue for a data breach, you can contact our team for more help and support.
More Tips On Proving A GDPR Breach Compensation Claim
When it comes to making a GDPR breach compensation claim, evidence is vital. One of the most important pieces of evidence you can provide your solicitor is a letter or email from the organisation that committed the breach.
Such a letter would usually state that your data has been breached, when it occurred, and details given on the types of personal data exposed, for example, your name, address or, in the most serious of cases, your sensitive or financial information.
If you don’t have any correspondence like this, we recommend getting in touch with the organisation to make a complaint.
Under the UK GDPR, they must provide a response. However, should they fail to do so within 3 months of your initial complaint, you can escalate the matter to the ICO, who may conduct an investigation.
The findings of an ICO report on the incident would also help prove your data breach claim.
If you’ve also been to see your GP or perhaps visited the hospital due to the stress and worry the breach has caused you, the medical notes from these visits would also help you prove your claim.
Medical records like this may also help your solicitor assess how much compensation you could be entitled to for the GDPR breach.
To learn more about claiming compensation for a data breach, get in touch today. The advice we provide is completely free and carries no obligation on your part to take the matter any further.
Accepting A Data Breach Settlement Offer
During your data breach claim, you and your solicitor will be working towards getting an offer of compensation that you’re happy with. However, you don’t have to accept the first offer. Instead, your solicitor might advise you to make a counteroffer if they think it the best course of action.
Although a solicitor can provide advice using their knowledge of handling other data breach cases, they can’t make any decisions for you. It’s your decision when to accept an offer. However, your solicitor will always guide you through the process if you’re ever unsure.
For more information on how a solicitor can help you, see below.
Data Breach Claims – No Win No Fee Solicitors
If you have a valid case to sue for a GDPR data breach, then you can discuss your potential claim with our advisors. If they determine you do have a strong case, then they can connect you with a No Win No Fee solicitor on our panel who can then support your data breach claim.
Our panel of solicitors can support data breach claims under a Conditional Fee Agreement. Under this type of agreement, you would not be required to pay your solicitor for their work either upfront or while the claiming process is ongoing.
If you are successful with your claim, your solicitor will take a success fee as payment. This means they’ll subtract a small, legally capped percentage from your compensation. Thanks to the legal cap, you’re guaranteed to receive most of the compensation for a successful claim. If you are unsuccessful, you’re usually not required to pay your solicitor for their services.
Please reach out to our advisors today to discuss more about claiming data breach compensation with a No Win No Fee solicitor, or to discuss other relevant aspects such as data breach compensation examples.
Get Free Data Breach Claims Advice
Our advisors are available 24/7 to provide you with free legal advice. As well as answer any questions you might have. Additionally, they can connect you with a data breach solicitor if you’re ready to make your claim.
We want to hear from you about how a data breach has affected you or someone you know. Contact us on the following so you can get started with your claim today:
- Telephone number – 0800 408 7827
- Live chat at the bottom of the page
- Send us an enquiry using the form, and we’ll contact you at your specified time
Resources
- Did your employer breach your data privacy? If so, see our guide on how to sue your employer.
- For more information on what to do if your local council breached your personal information, see our guide.
- For more detailed information on how the GDPR applies to you, visit this guide on the ICO website.
- If you’re unsure how companies use your data, the ICO has created a guide on being more data aware.
- Here is the full GDPR document if you require any further information.
- If you’ve been harmed by medical negligence, see our guide on suing a hospital for more information.
Personal Injury Claim Guides You Can Also Read
- Slip Or Trip Accident Claims
- How To Sue For An Injury In A Public Place
- How To Sue A Store For An Injury
- Criminal Injury Claims
We hope you found our guide on how you can sue for a GDPR data breach useful. Thank you for reading.