Find a Solicitor for your

GDPR Breach

GDPR Data Breach Claims

GDPR laws are a set of rules designed to protect personal data. They govern how businesses and organisations can use and store personal data.

Businesses don’t always manage customer data as they should under GDPR laws. Big companies are often targeted by hackers attempting to steal personal data, which can lead to large data breach claims and payouts for affected customers. Many types of data can be breached including credit and debit cards, bank accounts, NHS, and government breaches.

If you feel your data has been breached, you may be able to claim compensation. Our network of specialist data breach solicitors can help you make your case and increase your chances of success.

Get in touch today for a free case assessment and no-obligation quote for the services of an expert lawyer.

• What are my rights under data protection law?

• What are the consequences of a data breach?

• How do I know if my data has been breached?

• What is an example of a data breach claim?

• What should I do If my data is breached?

• Who can claim compensation for a data breach?

• What is the ICO?

• When can I make a data protection complaint against an organisation?

• How do I complain about an organisation?

• What can you claim for following a GDPR breach?

• How much is a GDPR claim worth?

• What is the time limit for GDPR claims?

• Is a data breach a criminal offence?

• Who is liable when a data breach happens?

What are my rights under data protection law? 

Article 5 of the UK GDPR laws set out seven data protection principles for companies to follow to protect their customer’s right to privacy:

1. Data must be processed lawfully, fairly, and transparently

2. Data collection must be for specific, explicit, and legitimate purposes

3. Data collection should be limited to what is necessary

4. Data must be accurate 

5. Data should be held only as long as necessary 

6. Appropriate security measures should be taken

7. A data controller must be able to demonstrate compliance with the data protection principles

Companies and institutions must embed these principles at the heart of their data processing policies. This is because data holders are accountable for the information they hold and must be able to demonstrate compliance with the data protection principles.

What are the consequences of a data breach?

Your data should be kept safe as, if it gets out, it can cause financial harm.

Incorrect data can also be harmful too. For example, if your medical records are incorrect, you might not get the right treatment. Similarly, mistakes by the police, like a false criminal record, can affect your life, including your job or prospects.

For businesses, breaching data protection rules can lead to big fines of up to £17.5 million or 4% of their yearly annual turnover, whichever is higher. They might also face a damaged reputation and lose the trust of customers.

How do I know if my data has been breached?

If you suspect your data has been breached, there are steps you can take to confirm it. Normally, the company should inform you via email or text, but sometimes it takes a while to realise and notify everyone. You can also contact the data controller to see if your data was involved in the breach. Online services can also help you check if your phone number or email has been compromised.

What is an example of a data breach claim?

Common examples of data breaches include:

• Bank data breaches

• Medical data breaches

• Government agency data breaches

• Police data breaches

• Data breaches caused by FOI requests

• Social services data breaches

• School data breaches

• App and website data breaches

• Charity data breaches

These sectors are the most common for data breaches, and if your data is breached in any of the above, you may have a data breach claim. 

The following examples of data breach examples are taken from the Information Commissioner’s Office:

• A hospital suffers a breach that results in accidental disclosure of patient records. There is likely to be a significant impact on the affected individuals because of the sensitivity of the data and their confidential medical details becoming known to others. This is likely to result in a high risk to their rights and freedoms, so they would need to be informed about the breach

• A university experiences a breach when an employee accidentally deletes a record of alumni contact details. The details are later re-created from a backup. This is unlikely to result in a high risk to the rights and freedoms of those individuals. They don’t need to be informed about the breach.

What should I do If my data is breached?

If you discover a data breach you should:

1. Follow the guidance provided by the data controller, if they've informed you about the breach.

2. Secure your accounts, especially those flagged in the breach notification. Always follow best practices for passwords to reduce this risk.

3. Consider setting up a fraud alert, which notifies lenders processing credit applications that you may be a victim of fraud or identity theft.

4. Monitor your financial accounts for any suspicious activity.

Who can claim compensation for a data breach?

You're eligible to claim compensation for a data breach under GDPR if the breach occurred due to wrongful actions by the data controller, such as negligence, and if you've suffered damage, either financial or emotional, as a result.

If you've been offered free credit monitoring, this could also support your claim.

What is the ICO?

The ICO, or Information Commissioner’s Office, is an independent authority in the UK responsible for data protection and information rights. They offer advice, guidance, support, and enforcement for individuals and organisations on data protection, freedom of information, and subject access requests.

When can I make a data protection complaint against an organisation?

You can make a data protection complaint when an organisation:

• Doesn't respond in the right way to your request for personal information

• Fails to keep your information secure

• Holds inaccurate information about you

• Discloses information about you without your consent

• Keeps your information longer than necessary

• Uses your information for purposes other than originally intended

• Doesn't respect your data protection rights

How do I complain about an organisation?

If you have reason to make a complaint, you should first complain directly to the organisation in writing, stating the problem and how you want them to put it right. Many businesses have formal procedures to deal with these types of complaints.

If you are unhappy with their response, you can complain to the ICO. They will investigate your claim and take action against anyone who's misused your personal data.

What can you claim for following a GDPR breach?

GDPR breach claims can include material damages and non-material damages.

Material damages include financial losses, while non-material damages result from the emotional impact of the breach.

How much is a GDPR claim worth?

The compensation you can receive from a data breach claim will vary depending on the severity of the breach. Compensation amounts usually range between £1,000 and £42,900. 

What is the time limit for GDPR claims?

You should bring a data breach claim as early as possible because there are strict deadlines.

If you are claiming against a public company, you have six years from the date you were informed about the breach. There is a shorter limit of one year when claiming against a public body, like the council or the police. 

The timeline can vary depending on the specific circumstances of the claim so it is always best to seek legal support when you want to make a claim.

Is a data breach a criminal offence?

Data breaches can be considered a criminal offence under the Data Protection Act 2018 (DPA) in certain circumstances. 

For example:

• Obstructing the ICO when inspecting personal data, or failing to provide reasonable assistance is considered an offence under Section 119 of the DPA.

• Under Section 132, ICO staff can be prosecuted for disclosing data obtained under their duties.

It is also a criminal offence to unlawfully obtain or access someone else’s personal data and is punishable by a fine in the Magistrates’ or Crown court.

Who is liable when a data breach happens?

Usually, the data holder (the organisation that processes an individual’s data) is liable for data breaches. This is true even when the breach is the fault of a third party responsible for housing the data.

The data owner is responsible for carrying out risk assessments to ensure that the location they hold data is secure and has strong security measures. 

The data holder may be responsible if the data owner can prove that they took all reasonable steps to ensure that the data holder had appropriate security. This would be the case if the data holder updated their systems and experienced a leak because of the update.

How can Lawhive help?

At Lawhive, our network of commercial solicitors can support you in claiming compensation if your data was breached due to negligence and you've experienced harm as a result.

Get in touch today for a free case assessment to discuss your needs and next steps.