Data breach compensation amounts: How much could you claim?
Data breach compensation amounts: How much could you claim?
If your personal information has been exposed, lost, stolen or shared without permission, one of the first questions you may have is: how much compensation can I get for a data breach?
While there isn’t a standard data breach compensation amount in England and Wales. How much data breach compensation you could get will depend on the individual circumstances of your case, including what personal information was stolen or breached, the impact the breach has had on you and whether you suffered any financial losses, emotional distress or psychological harm as a result of your data being breached.
This is because compensation for a successful data breach claim can potentially cover both material damages, such as money you have lost, and non-material damage, including distress or emotional injury caused by the breach.
This guide explains how data breach compensation amounts are calculated, what can affect the value of a claim and the evidence that may be needed to establish how a breach has affected you.
Is there an average data breach compensation amounts in England and Wales?
There is no fixed or average compensation amount for a data breach in England and Wales.
Every claim is different, so there is no way to provide a specific compensation amount for all claims in general. For example, two people could have the same type of personal information exposed but experience completely different consequences.
One person may discover the breach quickly, change their passwords and suffer little lasting impact. Another person affected by the same breach could experience fraud, financial losses or significant psychological distress.
The compensation awarded would therefore need to reflect the individual harm suffered rather than simply the fact that a breach occurred.
Can you claim compensation for a data breach?
Under UK data protection law, you may have the right to claim compensation where an organisation’s failure to comply with data protection requirements causes your data to be breached and causes you damage. However, experiencing a data breach does not automatically mean you will receive compensation.
A successful claim will generally require evidence that an organisation was responsible for a breach of your data protection rights and that you suffered material or non-material damage as a result. The individual circumstances and consequences of the breach need to be considered. This is why it is always good to consult a specialist data breach solicitor, as they will be able to review your case and advise you on whether you have a claim and how much you could potentially get in compensation.
How is data breach compensation calculated?
The value of a data breach compensation claim will depend on the damage you have suffered. Compensation is usually divided into two categories:
| Type of damage | What it means | Examples |
| Material damage | Financial losses caused by the breach | Stolen money, fraudulent transactions, loss of earnings or other financial costs |
| Non-material damage | Emotional or psychological harm | Distress, anxiety, depression or other recognised psychological effects |
Some claims may involve only one type of damage, while others can involve both. If a claim involves both, you can usually expect to claim more compensation.
Examples of material damage caused by a data breach
Material damage refers to financial losses resulting from the misuse or exposure of your personal information. Depending on what happened, this could include:
- Money stolen from a bank account
- Fraudulent transactions
- Identity theft
- Loans or credit taken out fraudulently in your name
- Damage to your credit record
- Loss of earnings
- Costs incurred trying to protect your identity or finances
- Other expenses directly resulting from the breach
Keep a record of any losses you suffer, as this can be important when establishing the value of your claim and providing evidence to support it. Keep bank statements, invoices, correspondence and credit reports as these could all potentially help demonstrate the financial impact of a breach.
Examples of non-material damage caused by a data breach
There are more consequences to a data breach than simply losing money. Often people don’t realise the true impact having your data breached can have on you and your life. Finding out that private information has been exposed can be extremely distressing, particularly when the information involved is highly sensitive.
A breach could potentially cause:
- Anxiety
- Stress
- Embarrassment
- Loss of sleep
- Fear of identity theft or fraud
- Depression
- Damage to personal relationships
- Post-traumatic stress disorder in particularly serious circumstances
Compensation can potentially be awarded for distress or psychological harm even where the claimant has not also suffered financial loss. This was the case when the Court of Appeal decided in the milestone Vidal-Hall and others v Google Inc case that compensation could be sought for distress without the claimant also having to demonstrate financial loss.
What affects the amount of data breach compensation you could receive?
There is no simple data breach compensation calculator capable of determining exactly what your claim is worth. The best way to determine how much compensation you could receive is to speak to a specialist data breach solicitor. They will be able to assess your case and individual circumstances of the breach to provide a more accurate data breach compensation amount.
Some of the main factors that could affect the amount of compensation include:
The sensitivity of the information
The nature of the information exposed can be particularly important. A breach involving an email address may have very different consequences from the disclosure of someone’s:
- Medical records
- Financial information
- Sexual orientation
- Biometric information
- Criminal records
- Religious beliefs
- Personal correspondence
- Home address or location information
Certain types of information are considered particularly sensitive under data protection legislation and require additional protection. However, the sensitivity of the information alone does not determine the value of a claim. The consequences of its disclosure will also need to be considered.
How widely the information was disclosed
A document accidentally emailed to one unintended recipient may have a different impact from information being published online or accessed by a large number of people. Factors such as who received the information, how long it was accessible and whether it was subsequently shared could therefore be relevant.
Financial losses
Where a breach leads directly to fraud, identity theft or other financial consequences, these losses may form part of the compensation being claimed.
Emotional distress
The extent and duration of the distress caused by the breach can also affect compensation. There is a significant difference between temporary concern that you quickly resolve and serious psychological harm that affects someone’s ability to work, sleep, socialise or carry out normal daily activities.
Psychological injury
Where a data breach causes a recognised psychological condition, medical evidence may be used to establish the nature and severity of the injury. This could include conditions such as:
- Depression
- Anxiety disorders
- Post-traumatic stress disorder
- Adjustment disorders
An independent medical assessment may be required when valuing this element of a claim.
How long do you have to claim data breach compensation?
In the UK, you generally have around six years to make a data breach claim. This starts from the moment you found out about the data breach. Some specific exceptions do apply, however. If you believe you may have a claim, speak to a solicitor as soon as possible as this will give them time to investigate your claim and gather evidence promptly.
How do you claim compensation following a data breach?
If you believe your personal information has been breached, the first step is usually to establish exactly what happened and take action to protect yourself and your data.
You may want to:
- Contact the organisation responsible. Ask them to explain what information was compromised, how the breach occurred and who may have received or accessed your information.
- Keep evidence. Save correspondence, financial records and anything else showing the consequences of the breach.
- Take steps to protect yourself. Depending on the information exposed, this could include changing passwords, contacting your bank or monitoring your credit record.
- Report your concerns where appropriate. You may be able to raise the matter with the Information Commissioner’s Office if you are dissatisfied with the organisation’s response.
- Seek legal advice. A data breach solicitor can assess whether you may have grounds for a claim and help establish the potential compensation amount.
Solicitor commentary
“Whilst there is no minimum set amount of compensation available for data breach claims, case law provides us with useful guidance. As such, if you have at least been merely upset by a data breach incident, you may be able to claim upwards of £250 for any distress you have suffered.”
Dan Higham, Solicitor, Data Breach and Cybercrime.
HNK Solicitors can help you claim data breach compensation
If your personal information has been compromised and you have suffered financial loss, distress or psychological harm as a result, you may be entitled to data breach compensation.
At HNK Solicitors, we have a team of experienced data breach solicitors who can assess what happened, explain whether you may have grounds for a claim and help establish the compensation you could be entitled to based on your individual circumstances.
We understand that having private information exposed can be extremely distressing. Our team will guide you through the process, deal with the organisation responsible on your behalf and work to achieve the best possible outcome for your claim.
We offer free initial consultations and can handle eligible data breach compensation claims on a no-win, no-fee basis. Contact HNK Solicitors today for a free, no-obligation assessment of your claim.
Frequently asked questions
How much compensation can I get for a data breach?
There is no fixed data breach compensation amount. The value of a successful claim will depend on factors including any financial loss, distress or psychological injury you suffered and the evidence available to demonstrate that harm.
Is there a minimum data breach compensation amount?
There is no standard minimum payout that everyone affected by a data breach automatically receives. A claimant generally needs to establish that the breach caused compensable damage or distress.
How much compensation can you receive for a medical data breach?
There is no standard medical data breach compensation amount. The fact that medical information is very sensitive can be relevant to the amount, but compensation will depend on the consequences of the disclosure and the material or non-material damage suffered.
Can I claim compensation if I haven’t lost any money?
Potentially. Compensation may be available for distress or psychological harm caused by a data protection breach even where you have not suffered financial loss.
Does reporting a breach to the ICO get me compensation?
No. The ICO regulates compliance with data protection law but does not normally award compensation to individuals. A compensation claim is separate from an ICO complaint. You must make a civil claim for compensation, usually through an experienced data breach solicitor.
Reviewed by Dan Higham, Data Breach and Cybercrime solicitor.
