Data Breach & Privacy

Data breach claims arise under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 when an organisation fails to protect personal data, causing material or non-material damage to the data subject. Article 82 of UK GDPR gives individuals the right to compensation for breaches.

Common data breaches include hacking incidents exposing personal data, accidental disclosure of sensitive information, lost or stolen devices containing personal data, phishing attacks due to inadequate security, and unlawful sharing of data with third parties without consent.

The Information Commissioner's Office (ICO) investigates data protection complaints and can impose fines of up to £17.5 million or 4% of global turnover. While ICO enforcement action is separate from civil claims, ICO findings can support compensation claims. Group litigation orders (GLOs) enable mass claims.

Individual compensation typically ranges from £1,000 to £10,000 for distress and inconvenience. Cases involving identity theft, financial loss, or exposure of highly sensitive data (medical records, sexual orientation) can reach £10,000 to £50,000. Major data breaches affecting thousands of individuals have resulted in group claims worth millions. The limitation period is 6 years from the date of the breach or date of knowledge.