Claiming Compensation Under Data Protection Act

Originally written by Chris Nickson, updated by the editorial team on 2nd April 2026

You can claim compensation under the UK GDPR and Data Protection Act 2018 if an organisation's breach of data protection law meant that you suffered material or non-material damage. This is extreme, but if you have proof that it happened, it's a course worth considering. The burden of proof will lie with you of course, as you're bringing the action and though it should be relatively easy to find evidence of damage, distress can be a lot tougher to prove. It's always best to exhaust the other avenues first if you can.

Restrictions

Before you make a claim however, you have to distinguish between damage and distress - which can be a very tricky point and distress can be a very nebulous thing. Under the UK GDPR, you can claim compensation for non-material damage (including distress) without the restriction to special purposes. The special purposes exemption relates to different aspects of data protection law, not compensation claims.

Faulty Goods Rights Checker

Find out your legal rights on a faulty product in less than a minute.

Try our Faulty Goods Rights Checker free, here on this site →

How to Claim Compensation

If the organisation offers you compensation, then everything can be settled easily. If you can't reach an agreement however, you'll need to take them to court (although most organisations would prefer to pay a small amount than face the glare of bad publicity). You can either specify the amount of compensation you want the court to award you (known as "liquidated damages"), or leave the decision up to the judge ("unliquidated damages"). Your claim should also contain an application that demands the organisation remedy the breach in the Act that caused the damage in the first place.

Generally, if your claim is for less than £10,000, the court will allocate the case to the small claims track, which means you won't need to use a solicitor; you can handle the case yourself.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

The Amount of Compensation

The amount of compensation is up to the judge; the Act offers no guidelines for compensation levels. This means he has to take a number of things into account, including the extent of the breach and its effect on you.

Even in the case of liquidated, or specified damages, where the sum you've stated is simply the same as the amount you've lost because of the organisation's actions, the judge might disallow part of your claim. He can also award you a lesser amount than you asked for, or possibly even nothing at all.

Getting Your Money

In most instances however, if an organisation is found to have done wrong and you've proved damage and distress, you'll receive at least some money in compensation and the organisation will pay relatively promptly.

If they don't however, or they refuse or can't pay, that leaves them in breach of the court. This means that you have to return to court to learn how you can enforce the judgement. This might even involve new proceedings, which can end up being more time-consuming than the amount is worth.

As an extreme measure, consider starting bankruptcy proceedings against the organisation if they refuse to pay. This course of action often achieves very quick results, but shouldn't be taken hastily.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Faulty Goods Rights Checker lets you find out your legal rights on a faulty product in less than a minute. Try it now →

Showing 20 of 183 questions

Ask Consumer Rights Expert a Question

Loopylee 29/07/2019 at 10:37 pm

I used to work for a training company but left after the under handed techniques they used to get rid of my husband, so I left went off sick gave notice. They gave me an advance before I knew I was leaving, i had to go into an iva in april at the time of leaving. They called my iva this month to say that I had an office. That has upset me because they had no right to ring iva directly surely that's a breach of GDpr. Can I sue them for that. Thanks guys

MrsB 03/07/2019 at 5:42 pm

Hello,
Both myself and my husband was involved in a non fault accident in 2016 ,we both went through separate claims for injury , my husband is ans has cohersely controlled all my finances, and has been financially as well as emotionally and physically abusing me since 2010, due to having no control of my finances I still live with him effectively I'm stuck. Last year he was arrested for injuring me like a fool I dropped all charges as he would lose his job he has a very good job working with vulnerable adults, anyway to get back to my story , I was paid my claim for the accident in Nov 2017, as .y situation is so bad I didn't tell him and used it to pay off 2 debts , his claim has still not been settled as he is fighting for more money , basically the claim solicitors breached data protection and told him my claim was settled , when it was settled and for how much, and he is absoloutey fuming, he has made my life hell since finding out and is demanding money , I have complained to the solicitors for doing this all they did was apologise , can anyone help as to what my rights are they have put me in a terrible position , thank you x

fjhugh1 03/07/2019 at 1:56 pm

A social worker sent a letter to me but to the wrong address regarding adoption plans for my daughter. The letter was opened by the other household. Can i complain and get compensation. If so how do I go about doing it?

Gor 17/06/2019 at 11:10 am

Me and my wife work in the same company. The company now requested the passport and nin to be resubmitted from my wife as they are switching to a different system. She joined the company 3 years ago and as she had her passport and nin scanned when she was employed, we think the company lost her file. The file contains passport, nin, address, phone number, etc. We are worried that the file may be found and used for various purposes. Do we have a claim on that basis?

Em1 17/05/2019 at 7:48 am

Our solicitor emailed our mortgage information including debt and payments to someone we don't know. They then emailed the same person a week later instead if us . They didn't report the breach and after several days of us chasing and worrying we has to submit a second complaint to the partner who finally responded 24 hours after -1 week after our initial complaint and several chase emails that although we were her priority she had been on holiday and had only been back in the office 3 days. She confirmed the email address our financial and address and full names had been sent to was valid but it was too late she then offered us half of the legal fees we had paid her back and 12 months Equifax. We said no, so she upped it as a gesture of good will to the full refund if fees - this was on Friday but we felt we needed to discuss it with someone who could advise us like the ICO as our info was still out there. On Monday we told her we were discussing it with a specialist on the Tuesday as we had an appointment. Our appointment was 430pm . Wednesday morning after little time to think it discuss she gave us an ultimatum that if we didn't accept the offer would be withdrawn. So we felt we had no choice. Today she has demanded we agree to not contact the legal ombudsman or ICO and sign a letter to them effect before she will release the Equifax or oyr refund. Where do we stand legally here?
Thank you

J1 08/04/2019 at 8:20 am

I have noticed on my wage slip that a Court Order has been taken off my wage. As far as I am aware I have no court order outstanding and have not signed a consent form. Is my company in breach of data protection as they have given my NI number for this payment to be taken and I don't know who has this information.

The Big K 28/03/2019 at 3:32 pm

My ex employer has me still listed on the company's Meet The Team page, with info about my personal hobbies and achievements. I have asked him to remove it as I left in February but he responds to my email with a snide comment and still hasn't taken it down, despite the fact I can see new employees now on the page who started after I had left. He is seeking to gain revenue by using my experience to attract clients to his company. I am also featured in a promo video on their site for which I never signed a consent form and now wish to be disassociated with. What can I do please?

Tocon1 30/01/2019 at 5:57 am

My ex-partner put my email address down as a secondary email account for a credit reporting company (Equifax) for HIS credit report many years ago. I recently had a query with my report on a different website (Clear Score) and raised the query with them. They informed me that Equifax would investigate and come back to me, however Equifax responded to my query addressing it to my ex-partner, providing him access to my entire financial history which I had not given permission for. There were things on my report that I did not want my ex-partner to know about and now he has seen it all. Not only did they send the information to him, they even addressed the email to his name! This has caused me lots of distress and worry. My ex-partner may have given his authorization for them to use my email address as a back up to his report, but under no circumstances have I given permission. My personal finance information is just that, personal and a company who is meant to advise you on ways of keeping this information safe to avoid identity fraud has just provided it to someone so easily. Even after responding to their emails stating that they had made an error, they continued to reply to the email address of my ex-partner with me just cc’d in on the email. Can I get compensation for this breach, it has caused me lots of stress and worry, let alone tarnished my reputation.

Emma 19/01/2019 at 12:54 pm

Hello,
Eon, informed my old landlady of a outstanding dept i had with them ( that was for a old property i lived in) it caused me ALOT of stress abd worry and not only do the landlords know about it so do others as they have spread the word. Do i have a claim?
Many thanks
Emma

Dylan 03/12/2018 at 6:03 pm

I booked a holiday with friends and the company kept trying to make me the lead organiser which I repeatedly refused and emailed to say they were individual accounts. Finally i explained the reason why was because on previous holidays I have had to chase a person for money and even paid myself and not been fully refunded. They then forwarded this email to the person and he was totally upset and has stopped talking to me. The company has chases and threatened him but he has not replied. They have copied me into their emails to him even though I have told them it is none of my business. They are now threatening to cancel all the holidays and keep nearly all of the money. Even though everyone else has paid in full and on time. Is this a breach of personal information and can we stop this occurring as it is their fault the animosity has happened.

Tray 30/10/2018 at 12:19 pm

A social work gave out a report of my family to another family they wrote me a letter addmitting they breached data protection can I claim compansation

Trimble 29/10/2018 at 1:32 am

I was recently included as a possible defendant in an employment tribunal although the pursuer and myself reached an agreement prior to proceedings..however it has come to light that the other defendant an aleo (of the company I work for) who employee our companies HR services passed the details via our HR to my employer..I now face a possible disciplinary process that may result in my dismissal do I have a case for breach of gdpr and possibly compensation.

nadine 16/10/2018 at 6:45 pm

Hello I called candy to register my warrenty for an appliance and during this registration I was asked if I was comfertable being contacted by third party companies I told them i was not comfortable and to not give my information out to anyone but then ten minutes after I got off the phone I had a phone call from a marketing company ontop of me asking them not to give my informatio out I asked them themselfs not to contact me via phone only to contact via email as I have anxiety and it can be verry distressing having unexpected phone calls after telling them this I feel violated and unable to trust them or anyone with my phone number do I have a case ?

Lex 06/10/2018 at 3:27 pm

I made a call to social services To report a child being hurt , first they gave my name out after I said I wanted to stay Anonymous 4 x times on the call . Then after this they gave out my full name and address three weeks after !!! They have offered me £250 compo but I have been under so much stress and fear for my safety now .

Golfersbreach 24/09/2018 at 10:47 pm

Hi, I have found a secret camera hidden in my place of work. I feel alarmed and none of the staff have been informed of the camera or it’s reasons. This is very distressing and against GDPR rules. Do I have a case ? Rgds

Meemee 18/09/2018 at 6:24 pm

My comany was bought out via another company which I'm still working for. They have ask for all my personal information which my old company had. When questioned where all my information has gone I was told it has been lost and I must submit it all again. DBS. Insurance information ect. I'm very upset and worried to where this information had gone and what if it's fell in to the wrong hands. Where do I stand ?

ConsumerRightsExpert Editor 18/09/2018 at 3:31 pm

Sorry we can't give individual advice on things like this.

Elle 17/09/2018 at 1:02 pm

A solicitor acting on my behalf with the CICA sent a highly sensitive medical report with historic and current information to neighbours property even though they had previously been told they had sent post to the wrong address. They want to offer me compensation but would like to know what is an acceptable amount?

Meace 19/08/2018 at 11:07 pm

A large insurance company is dealing with our landladys claim as our house flooded. We recently discovered that our landlady had a call from a police station and a folder had been handed in. In the folder was all the details of the claim including our address, where we work, the times we go to work and come home, pictures of our home with out contents in it, pictures of my car with my registration number, our mobile phone number, the fact we have foster children and their ages. Given the new GDPR legislation I am aware that this is a big problem for the company and that they could be fined. They are investigating the matter and have intimated that there will be compensation - my question is how much is a reasonable amount of compensation given the fact that they have basically given someone everything they would need to rob me? Thanks

ConsumerRightsExpert Editor 10/08/2018 at 12:28 pm

You should speak to a solicitor about how much compensation would be realistic. You would need to assess things like distress, time, inconvenience etc.

Show All 183 Questions

Ask Consumer Rights Expert a question

Ask our editorial team a question and we will reply with our advice. Tell us as much about your situation as you can: the more detail you give, the more useful our answer can be.

You do not need to use your real name. Please do not include your full address, phone number, email address, or the names of other people. We may edit or remove identifying details for privacy and legal reasons.

Comments are moderated before publication.

Consumer Rights Act 2015 Checker Tool

Faulty Goods Rights Checker Tool

What to Do if Your Information Is Incorrect

Using the Law to Protect Your Personal Data

The Problems with Automatic Data Processing

Going to Court Over Data Protection