Data breach compensation by country: laws, fines and payouts compared
Checked against official sources Nov 8, 2026
Short answer
Only a few places give each victim a set amount by law: Korea (statutory damages up to ₩3 million) and California (US$107–799 per consumer per incident under the CCPA). Elsewhere you either take what the company offers, join a class action or prove your own damage in court. Company offers come fast (3–73 days in our cases); court settlements took 15 months to 3 years. As of 8 November 2026; general information, not legal advice.
Breach laws in 12 jurisdictions
| Country / law | Tell the regulator | Tell individuals | Maximum fine | How victims get paid | Compensation actually seen |
|---|---|---|---|---|---|
| Korea PIPA | 72 hours (1,000+ people, sensitive data or outside attack) | 72 hours; since 2026-09-11 even when a leak is only likely | 3% of total revenue; 10% for repeat, intentional or grossly negligent cases (from 2026-09-11) | Statutory damages up to ₩3M, punitive damages up to 5x, mediation and collective mediation | ₩100,000 per person (card-company ruling); company vouchers and discounts |
| Japan APPI | Preliminary report promptly (about 3–5 days), final in 30 days (60 if malicious) | Required; no fixed deadline | No administrative fines; up to ¥100M for a company breaching a PPC order | No statutory damages; tort claim under the Civil Code | ¥1,000–3,000 per person in Benesse rulings; company apology payments ¥500–5,000 |
| United States state laws, SEC, HIPAA | Listed companies: 4 business days after deciding it is material (SEC); health data 60 days (HIPAA) | Varies by state; California 30 days from 2026-01-01 | No general federal cap | Class action settlements; CCPA statutory damages US$107–799 per consumer per incident | AT&T: most people expected to get US$6.50–40 (up to US$5,000) |
| EU GDPR | 72 hours | Without undue delay if high risk | €20M or 4% of worldwide turnover | Art. 82 damages incl. non-material; representation by non-profits; representative actions | Germany's top court: about €100 for loss of control |
| United Kingdom UK GDPR | 72 hours | Without undue delay if high risk | £17.5M or 4% of turnover | Claim from the company, then court; the ICO cannot award money; uniform group claims limited | British Airways group claim settled (terms confidential) |
| Canada PIPEDA, Quebec Law 25 | As soon as feasible if real risk of significant harm | As soon as feasible | C$100,000 for knowingly not reporting; Quebec C$25M or 4% | Provincial class actions; Quebec punitive damages of at least C$1,000 | Desjardins settlement up to C$200.9M |
| Australia Privacy Act | Assess within 30 days, then as soon as practicable | As soon as practicable | Greater of A$50M, 3x the benefit or 30% of turnover | OAIC determinations can order compensation; class actions; privacy tort from 2025-06-10 (intentional or reckless) | First civil penalty A$5.8M (Oct 2025) |
| Brazil LGPD | 3 working days | 3 working days | 2% of revenue in Brazil, up to R$50M per violation | Individual or collective suits; no presumed moral damage for ordinary data (STJ 2023) | Netshoes R$500,000 collective damages (paid to a fund) |
| India DPDP Act 2023 | Without delay + detailed report in 72 hours (in force May 2027) | Without delay | ₹250 crore for failing to protect data | No compensation for individuals in the Act; penalties go to the government | Not confirmed |
| China PIPL | Immediately; from 2025-11-01 large incidents in 4 hours (1 hour for critical infrastructure) | Immediately (can be skipped if harm was prevented) | RMB 50M or 5% of last year's turnover | Damages with presumed fault; public-interest suits by prosecutors and consumer bodies | Public-interest suit settled (app fixes, deletion, apology; no damages) |
| Singapore PDPA | Within 3 days of assessing the breach as notifiable | On or after notifying the PDPC | S$1M or 10% of Singapore turnover | Private action for loss or damage (s. 48O) | Not confirmed (penalty example: SingHealth S$250,000) |
| Turkey KVKK | 72 hours | Shortest reasonable time | TRY 17,092,242 (2026) | General civil courts | Not confirmed (fine example: Yemeksepeti TRY 1.9M) |
Who can make the company pay, and how
- Korea: under PIPA Article 39-2 you can claim up to ₩3 million without proving the amount of loss, and the company must prove it was not at fault. Punitive damages went from 3x to 5x in 2023. In the 2014 card-company leak, the Supreme Court upheld ₩100,000 per person. Mediation proposals bind only if the company accepts.
- Japan: with no statutory damages, victims sue in tort. In the Benesse case the Supreme Court said on 23 October 2017 that leaking even a name and address can infringe privacy, and sent the case back; lower courts later awarded ¥1,000–3,000 per person.
- United States: no general federal breach law, so state law and class actions decide. California's CCPA gives US$107–799 per consumer per incident (inflation-adjusted in 2025) when a breach follows a failure to keep data secure. Listed companies must file an SEC Form 8-K within four business days of deciding an incident is material.
- EU: GDPR Article 82 covers non-material damage. In Österreichische Post (C-300/21), 4 May 2023, the EU Court of Justice said a breach of the rules alone is not enough, but national courts cannot require a seriousness threshold; in C-340/21 (14 December 2023) it said fear of misuse can be damage. Germany's Federal Court of Justice ruled on 18 November 2024 (Facebook scraping, VI ZR 10/24) that even a brief loss of control is damage and that about €100 would be unobjectionable.
- United Kingdom: the ICO cannot award compensation. In Lloyd v Google (10 November 2021) the Supreme Court refused a representative claim seeking the same sum for everyone for 'loss of control'.
- Australia: since 10 June 2025 people can sue for serious invasions of privacy (intentional or reckless). On 8 October 2025 the Federal Court ordered Australian Clinical Labs to pay A$5.8 million, the first civil penalty under the Privacy Act; penalties do not go to victims.
- Brazil: the Superior Court of Justice held on 7 March 2023 (AREsp 2.130.619) that a leak of ordinary personal data does not by itself prove moral damage; a February 2025 ruling (REsp 2.121.904) reportedly presumed damage for sensitive data.
- India: the DPDP Act sends penalties to the government and has no compensation for individuals. IT Act section 43A, which allowed compensation claims, is due to be removed when the core duties start in May 2027.
- China: PIPL Article 69 makes the company pay unless it proves it was not at fault, and Article 70 lets prosecutors and consumer bodies bring public-interest suits.
Real cases: how much leaked, and how fast compensation came
Announced is the first public disclosure by the company or a regulator; the compensation date is when the company announced an offer or a court or regulator decided. Days are the difference between the two dates. A dash means we could not confirm one of the exact dates.
| Company (country) | Leaked | Announced | Compensation or award | Date | Days |
|---|---|---|---|---|---|
| Coupang (Korea) | 33.7M accounts | 2025-11-29 | ₩50,000 in four vouchers per person, ₩1.685 trillion in total | 2025-12-29 | 30 |
| SK Telecom (Korea) | 23.24M people | 2025-04-22 | About ₩500 billion package (discounts, data); mediation offer of ₩300,000 per applicant (2025-11-03) rejected on 11-20 | 2025-07-04 | 73 |
| KT (Korea) | 16,647 people (regulator's count) | 2025-09-11 | About ₩450 billion package (data, insurance, no exit fees) | 2025-12-30 | 110 |
| Times Car (Japan) | 6,628,007 records | 2026-09-25 | ¥3,000 equivalent for customers whose ID images leaked (1,464,800 images) | 2026-10-23 | 28 |
| Onamae.com Desktop Cloud (Japan) | 26,739 servers possibly affected | 2026-10-21 | ¥5,000 to every user | 2026-10-24 | 3 |
| Benesse (Japan) | 35.04M records | 2014-07-09 | ¥500 voucher (or donation) | 2014-09-10 | 63 |
| AT&T (US) | About 73M people + call records | 2024-03-30 | US$177M class settlement, preliminary approval (final approval Oct 2026) | 2025-06-20 | 447 |
| Equifax (US) | About 147M people | 2017-09-07 | Settlement with the FTC and others: at least US$575M, up to US$425M for consumers | 2019-07-22 | 683 |
| Desjardins (Canada) | 2.9M+ people | 2019-06-20 | 12 months of credit monitoring the same day; class settlement up to C$200.9M approved | 2022-06-14 | 1,090 |
| Optus (Australia) | About 9.5M people | 2022-09-22 | 12 months of free credit monitoring for the most affected | 2022-09-26 | 4 |
| Medibank (Australia) | 9.7M people | 2022-10-13 | ID replacement costs, identity monitoring, hardship fund, mental health line | 2022-10-25 | 12 |
| Australian Clinical Labs (Australia) | 223,000+ people | Feb 2022 (incident) | A$5.8M court penalty (not paid to victims) | 2025-10-08 | — |
| British Airways (UK) | 429,612 people | 2018-09-06 | ICO fine £20M (2020-10-16); group claim settled, terms confidential | 2021-07-06 | 1,034 |
| Facebook scraping (Germany) | About 533M users worldwide | Apr 2021 (published) | Federal Court of Justice: about €100 for loss of control possible | 2024-11-18 | — |
| Netshoes (Brazil) | 1,999,704 people | 2017–2018 | Agreement with prosecutors: R$500,000 collective damages to a fund, nothing paid to individuals | 2019-01-16 | — |
Two patterns stand out. Company offers are quick: 3 days at Onamae.com, 4 at Optus, 28 at Times Car, 30 at Coupang. But they are mostly vouchers or services, and the company sets the amount. Money through the courts is slow: settlements in the US, Canada and the UK came 15 months to 3 years after disclosure, and the Optus and Medibank cases in Australia were still open in November 2026. When a company rejects a mediation proposal, as SK Telecom did, victims are left with a lawsuit.
What this means for you
- US: settlements have claim deadlines. Keep the breach letter and claim only on the court-approved settlement site; see our open settlements.
- UK and EU: write to the company asking for compensation, and complain to the regulator if needed. You do not need a claims firm (our UK guide).
- Canada and Australia: complain to the OPC or the OAIC. The OAIC can order compensation; in Canada the Federal Court can award damages after the OPC report (Australia, Canada).
- Korea and Japan: check the company's notice for who qualifies and the deadline. In Korea, statutory damages (up to ₩3M) do not need proof of the loss amount.
- Anywhere: never pay a fee or give a password or card number to someone offering to file a claim for you. Fake 'compensation' messages rise after big breaches.
General information gathered from public sources up to 8 November 2026, not legal advice. Laws and court decisions change; check official guidance or a lawyer before you file.
Official sources
- Korea Law Information Center: PIPA Articles 39 and 39-2
- Digital Daily: amended PIPA in force 2026-09-11 (10% fines, notice of likely leaks)
- eToday: Supreme Court upholds ₩100,000 per person for card data leak (2018-12-27)
- SBS Biz: Coupang discloses 33.7M accounts (2025-11-29)
- Hankyung: Coupang ₩1.685 trillion compensation (2025-12-29)
- Byline Network: SK Telecom USIM breach notice (2025-04-22)
- Financial News: SKT ₩500 billion package (2025-07-04)
- Money Today: SKT ₩300,000 mediation decision (2025-11-04)
- SBS Biz: SKT rejects mediation (2025-11-20)
- Newsis: KT confirms leak of 5,561 subscribers' IMSI (2025-09-11)
- Herald Economy: KT ₩450 billion package (2025-12-30)
- Financial News: KT incident timeline and fine (2026-07-30)
- Japan PPC: responding to leaks
- Times Car: first notice (2026-09-25)
- Times Car: fifth report (2026-10-23)
- Onamae.com: fourth report (2026-10-24)
- INTERNET Watch: Benesse leak disclosed (2014-07-09)
- ITmedia: Benesse 35.04M records, ¥500 voucher (2014-09-10)
- Monolith Law: Japanese damages rulings in leak cases (Benesse)
- California Privacy Protection Agency: CCPA CPI adjustment
- SEC: cybersecurity disclosure rules (2023-07-26)
- McDonald Hopkins: California SB 446, 30-day notice from 2026-01-01
- 45 CFR 164.404 (HIPAA breach notice)
- Insurance Journal: AT&T $177M settlement preliminary approval (June 2025)
- WCAX: AT&T settlement gets final approval (2026-10-09)
- FTC: Equifax settlement (2019-07-22)
- EUR-Lex: GDPR
- EUR-Lex: Representative Actions Directive (EU) 2020/1828
- EUR-Lex: judgment C-300/21 Österreichische Post
- EUR-Lex: judgment C-340/21
- Bundesgerichtshof: press release 218/2024 (VI ZR 10/24)
- UK Supreme Court: Lloyd v Google
- Wired-Gov: ICO fines British Airways £20m (October 2020)
- The Register: British Airways group claim settled (2021-07-06)
- Justice Laws: PIPEDA s. 10.1
- Justice Laws: PIPEDA s. 28 (offences)
- OPC: Desjardins investigation (PIPEDA 2020-005)
- CTV News: Desjardins $200M settlement approved (June 2022)
- OAIC: the Notifiable Data Breaches scheme
- OAIC: civil penalties
- OAIC: Australian Clinical Labs penalties (2025-10-09)
- OAIC: statutory tort for serious invasions of privacy
- OAIC: civil penalty action against Optus
- EFTM: Optus offers 12 months of Equifax Protect (2022-09-26)
- OAIC: civil penalty action against Medibank
- Bitdefender: Medibank support package (2022-10-25)
- InDaily: Medibank faces dual court actions (2026-10-02)
- Brazil Chamber of Deputies: LGPD text
- ANPD: security incident reporting regulation (3 working days)
- Dizer o Direito: STJ AREsp 2.130.619
- Tecnoblog: Netshoes agreement with prosecutors (2019)
- MeitY: Digital Personal Data Protection Act 2023
- National Herald: DPDP Rules 2025 notified, phased rollout
- Cyberspace Administration of China: PIPL text
- Cyberspace Administration of China: incident reporting measures (from 2025-11-01)
- China Daily: Hangzhou prosecutors' public-interest suit (2021-04-22)
- Singapore Statutes Online: PDPA 2012
- Personal Data Protection Commission Singapore
- KVKK: data breach notification (Board decision 2019/10)
- KVKK: 2026 fine amounts
- KVKK: Yemeksepeti decision 2021/1324
General information, not legal advice. Teollimi does not file claims or refer people to claims firms.