When an organisation loses control of someone’s personal data, whether through a hack, a misdirected email, or a careless disclosure, the person affected in the UK has a specific legal route to compensation. That route runs through the UK GDPR, not through the regulator most people contact first. This guide covers the position under UK law, which applies across England, Wales, Scotland and Northern Ireland, since the UK GDPR and the Data Protection Act 2018 extend UK-wide, though a compensation claim itself is brought in the courts of the relevant nation.
The legal basis: Article 82
The right to compensation comes from Article 82 of the UK GDPR, which states that any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to receive compensation from the controller or processor responsible for the damage. A controller processing personal data is liable for damage caused by processing that breaches the Regulation. A processor, broadly an organisation that processes data on a controller’s behalf, is liable only where it has failed to comply with obligations specifically directed at processors, or where it has acted outside or contrary to the controller’s lawful instructions. Either party can avoid liability by proving it is not in any way responsible for the event that caused the damage.
Material and non-material damage
Article 82 draws a deliberate distinction between two kinds of harm. Material damage covers a quantifiable financial loss, for example money lost to a fraudster who used leaked data. Non-material damage covers harm that is not financial, most commonly distress, anxiety or loss of control over personal information. UK GDPR does not require a claimant to show a monetary loss before compensation is available; distress on its own can support a claim, though the damage still has to be real and the court will not award compensation for a trivial or inconsequential breach.
What proving damage actually involves
A claimant still has to demonstrate, to the court’s satisfaction, that they suffered genuine damage and that the damage resulted from the infringement in question. If a court is not persuaded that any real damage occurred, it will not award compensation, and a claimant who brings a weak or exaggerated claim can be ordered to pay the other side’s costs. This is why claims tend to focus on specific, describable consequences, such as a documented period of anxiety, unwanted contact resulting from a leaked address, or a demonstrable financial loss, rather than the fact of the breach alone.
Where a claim is actually decided
The Information Commissioner’s Office regulates data protection compliance and can investigate an organisation, issue enforcement notices and impose fines, but the ICO has no power to award compensation to an individual, even where it finds an organisation has broken the law. If an organisation will not agree to pay compensation directly, the next step is a claim in the courts, typically the County Court in England and Wales, brought under Article 82. An ICO finding against the organisation can be useful supporting evidence in that claim, but a court reaches its own, independent decision on both liability and the amount of damage, and its conclusion does not have to match the ICO’s.
Practical steps before a claim
Before litigation, the usual route is to complain to the organisation directly, since data protection law expects organisations to have a process for handling complaints and, where appropriate, offering redress. A complaint can also be made to the ICO, which can prompt an investigation and give the claimant a documented assessment to rely on later, though it will not itself deliver a payment. Only a court, or a settlement agreed directly with the organisation, can actually produce compensation.
FAQs
Can I claim compensation just because my data was breached, with no other effect?
Not reliably. A court needs to be satisfied that real damage, financial or non-material, actually resulted from the breach; the breach happening is the starting point, not the whole claim.
Does the ICO pay compensation if it upholds my complaint?
No. The ICO can investigate and take enforcement action against an organisation, but it has no power to award compensation to an individual.
Do I need to show I lost money to claim anything?
No. Article 82 allows compensation for non-material damage such as distress, separately from any financial loss.
Who do I sue if a processor, not the original organisation, caused the breach?
A processor can be liable directly where it breached obligations aimed specifically at processors, or acted outside the controller’s lawful instructions; otherwise the controller organisation you dealt with remains the primary target.
The bottom line
UK GDPR gives a genuine, standalone right to compensation for a data breach under Article 82, covering both financial loss and non-material harm such as distress, and it applies across the UK. The regulator that most people think of first, the ICO, investigates and can take enforcement action, but it cannot pay compensation; that has to come from the organisation directly or from a court, most often the County Court in England and Wales, in a claim brought under Article 82. This is general information, not legal advice on an individual breach.