Guide · Data breaches

They lost your data.
The liability is theirs.

When a company leaks your data, the anxiety, the spam wave, the card you had to cancel: the law treats that as their liability, not your bad luck. Compensation for breach damage, including distress, is written into the UK GDPR itself.

1.The right to compensation

Regulation (EU) 2016/679 (UK GDPR, retained) · art.82 · Right to compensation and liability
"Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."
In plain English: If a company mishandles your personal data and you suffer harm or distress as a result, you have the legal right to claim financial compensation from them. This applies whether the damage is physical, financial, or emotional.
§ Read the full text on legislation.gov.uk →

2.They may have owed you a warning

For high-risk breaches, the organisation must also tell you directly and promptly, not let you find out from the news.

Data Protection Act 2018 · s.168 · Compensation for contravention of the UK GDPR
", “non-material damage” includes distress. (2)Subsection (3) applies where— (a)in accordance with rules of court, proceedings under Article 82 of the UK GDPR are brought by a representative body on behalf of a person, and (b)a court orders the payment of compensation. (3)The court may make an order"…
In plain English: UK law confirms that compensable damage includes distress: you don't need to show financial loss to have a claim.
§ Read the full text on legislation.gov.uk →

3.What to do

Want to know where you stand?

Tell us what happened in your own words. We check it against the law above, free, and give you a straight answer either way. If the law is on your side, your formal letter, citing the exact provisions, is £2.99.

Check where I stand, free →

UK GDPR applies UK-wide. This is guidance to help you understand your rights, not formal legal advice, and we're entirely independent: no affiliation with Citizens Advice, GOV.UK or any law firm. Every quotation above links to the official text so you can check us. Law verified current at July 2026.