Data Breach Complaints

If you discover your personal data has been breached — whether through a notification from the organisation, a news report, or noticing suspicious activity on your accounts:

• If financial data was involved: Contact your bank or card provider immediately. Request replacement cards if your card details may have been compromised. Monitor your statements for any unauthorised transactions and report them to your bank at once.
• If login credentials were involved: Change your passwords on the affected service and any other services where you use the same password. Enable two-factor authentication where available.
• Check your credit file: Use a free credit checking service to see if any credit applications have been made in your name.
• Report fraud: If you believe you have been a victim of identity fraud resulting from the breach, report to Action Fraud (actionfraud.police.uk).

If you believe an organisation has breached your data rights — by failing to protect your data adequately, failing to notify you of a breach, or mishandling your data in any other way — you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

The ICO is the UK's data protection regulator. It can investigate organisations and issue enforcement notices, fines, or require specific action. However, the ICO cannot itself award you compensation — for compensation, you must pursue a civil claim.

Before complaining to the ICO, raise your concern directly with the organisation first. Give them a reasonable period to respond (usually around four weeks). If they do not respond satisfactorily, you can then escalate to the ICO.

Under Article 82 of UK GDPR, you have the right to claim compensation from an organisation that has breached your data rights if you have suffered damage as a result. Damage includes both material damage (financial loss) and non-material damage (distress, anxiety, loss of control over personal information).

To claim compensation:

• Write to the organisation's Data Protection Officer (DPO) setting out the breach, the damage you have suffered, and the compensation you are seeking
• If the organisation refuses, you can issue a civil claim in the County Court
• Some solicitors take data breach compensation claims on a no-win no-fee basis for larger breaches

Be wary of claims management companies advertising data breach compensation — they often charge high fees that reduce your net compensation significantly.

The Information Commissioner's Office (ICO) is the UK's independent data protection regulator, established under the Data Protection Act 2018. Understanding how the ICO investigates complaints — and its limitations — helps you decide whether an ICO complaint, a civil claim, or both is the right approach for your situation.

The ICO complaints process: Before complaining to the ICO, you must raise your concern directly with the organisation and allow them a reasonable period to respond — typically three months. The ICO's online complaint form asks you to confirm this step. Once submitted, the ICO will assess whether your complaint falls within its remit and whether it raises issues that warrant investigation. The ICO receives a very large volume of complaints and prioritises those that raise potential systemic failures or serious harms. For individual low-level complaints, the ICO may close the case with guidance rather than a formal investigation. This does not prevent you pursuing a civil compensation claim.

Evidence to gather for an ICO complaint and civil claim: Document everything from the moment you discover or suspect a breach. Your evidence file should contain: the notification from the organisation (if you received one) with the date; a description of what data was affected (your name, address, financial details, health information, etc.); evidence of any harm suffered — financial fraud, identity theft, distress — with as much documentation as possible (bank statements, medical notes, records of emotional impact); your correspondence with the organisation's DPO; the organisation's response or lack of response; screenshots of any unauthorised use of your data (for example, fraudulent accounts or applications made in your name); and a credit file check showing any adverse entries resulting from the breach.

What the ICO can and cannot do: The ICO can investigate organisations and issue enforcement notices, monetary penalties (fines), information notices, and orders requiring specific action. However, the ICO cannot itself award you compensation — for that, you need a civil claim. An ICO investigation or enforcement decision can be very useful evidence in a civil claim, as it establishes the facts of the breach and the organisation's culpability. The ICO also has a complaints resolution function for less serious cases, which can result in the organisation being required to take specific action (for example, deleting data or providing a proper subject access response) without a formal enforcement notice.

Group litigation for large-scale breaches: Where a data breach has affected many people — such as large-scale cyber attacks or systemic data mishandling — group litigation actions (brought by claimants collectively) can be an effective route. Several data breach group actions have resulted in settlements, including actions against major retailers, healthcare providers, and public sector bodies. If you were affected by a widely reported data breach, search for existing group actions before bringing an individual claim — joining an existing action is often more efficient and cost-effective than bringing a claim alone. Specialist data protection solicitors and law firms advertising class actions can advise on whether a group action is available for your breach.