Data breach compensation in the UK: your rights

Step 1: complain to the organisation

Write to the organisation, say what happened and what you want, including compensation. The ICO recommends letting the organisation finish its own complaints process first.

Step 2: complain to the ICO if needed

If the reply is not good enough, complain to the ICO, ideally within three months of the organisation's final response. The ICO can tell the organisation to put things right, but it cannot award compensation.

Step 3: court, if the organisation will not pay

You can take legal action at any time; you do not have to complain to the ICO first. Before suing you must write to the organisation and follow the pre-action rules. Time limits for court claims depend on the type of claim and where you live in the UK, so get legal advice before relying on any deadline.

Do I need a claims management company?

No. The FCA says you do not need a claims management company and that claiming yourself is free. Firms that do this work must be authorised by the FCA or a legal regulator; check before signing anything.

What the company must do after a breach

Report it to the ICO within 72 hours of becoming aware, where feasible, and tell you without undue delay if the breach is likely to put you at high risk (ICO guide).

Protect yourself now

• Expect scam calls and emails pretending to be the breached company; the NCSC's advice explains what to watch for.
• Change reused passwords and turn on two-step verification.
• Report fraud to Report Fraud (0300 123 2040); in Scotland call 101.