TL;DR: Yes, under UK data protection law you can claim compensation if an organisation broke the law and caused you harm, including non-financial harm like distress. But the ICO can’t award compensation. You ask the organisation directly, and if it refuses, a court decides. If you can’t show damage or distress you may get nothing and could pay the other side’s costs, so the ICO strongly recommends independent legal advice first.
The right exists
According to the ICO, you can claim compensation if an organisation broke data protection law and that caused you harm. That covers:
- material damage, such as money you lost;
- non-material damage, such as distress.
What the ICO does and doesn’t do
The ICO investigates complaints and can fine organisations, but it cannot award you compensation, even when it finds the organisation broke the law. Its findings can be useful evidence, but a court makes its own decision. If you want the ICO to look at how your data was handled, see how to complain to the ICO.
How a claim works
- Ask the organisation first. Write explaining what happened, the harm it caused and what you want. Some organisations simply pay.
- If it refuses, write saying you intend to go to court. Courts expect you to have tried to settle.
- Go to court to enforce your rights, claim compensation, or both. There’s court guidance for England and Wales, Scotland and Northern Ireland.
- The judge decides the amount, based on how serious the breach was and its impact on you.
The risks nobody mentions in the adverts
“You could be owed £££ for the [big brand] breach” adverts are everywhere after a headline. The ICO’s warning is sobering: if you can’t show damage or distress, you may get nothing and could be ordered to pay the other side’s costs. Take independent legal advice before claiming. If you use a claims firm, read the fees carefully and check them on the FCA Firm Checker or with the Solicitors Regulation Authority.
And beware fake compensation calls: scammers love “you’re owed money for a breach,” the same way they piggyback on car finance redress.
Build your evidence
- keep the breach notification;
- note what happened next (phishing attempts, fraud, time spent, stress);
- keep bank statements showing losses;
- ask for your data with a subject access request.
Know what leaked
Before claiming, it helps to know which breaches you’re actually in. A free email exposure check shows the known breaches that include your email.
Frequently Asked Questions
Can I get compensation for a data breach in the UK?
Yes, if an organisation broke data protection law and caused you financial loss or distress.
Can the ICO award compensation?
No. The ICO can’t award compensation; you claim from the organisation or through the courts.
Can I claim for distress alone?
Non-material damage like distress is covered, but you need to show it. Get legal advice first.
Is there a risk in claiming?
Yes. If you can’t show damage or distress you may get nothing and could be ordered to pay costs.