The Assurance Desk
Part of the guide A data breach has happened: who do you call?
Is this a complaint or a compensation claim?
Ask what the person wants you to do. They may want an explanation, a change to how data is handled, payment, or several of these. Keep those requests clear in your response.
You must provide a way to make a data protection complaint and acknowledge it within 30 days. You must then take appropriate steps to respond, make enquiries, keep the person informed and give the outcome without undue delay. That acknowledgement period is not a general deadline for answering court papers.
| Route | What it can do |
|---|---|
| Complaint to the organisation | Requires a complaint process, acknowledgement and a response. |
| Complaint to the ICO | The ICO may give a view, but it cannot award compensation. |
| Agreed payment | The organisation and person may settle without a court claim. |
| Court claim | The court decides the case and any award; its view may differ from the ICO’s. |
What does the person need to show?
The compensation question is about damage caused by a breach of data protection law. The ICO’s guidance includes lost money and distress. Do not assume that every incident leads to the same claim or amount.
For a useful first review, gather the claim letter, the relevant data records and the account of what happened. Ask the legal adviser to separate the alleged breach, the claimed harm and the evidence linking them.
Read the claim in parts
- The alleged breach Which use of personal data is being challenged?
- The claimed damage What loss or distress is described?
- The evidence How is that damage linked to the alleged breach?
Does the ICO need to decide first?
No. A person does not have to complain to the ICO, or wait for its decision, before pursuing a court claim. The court reaches its own decision and may disagree with the ICO’s view.
The ICO makes its limit clear in its public guidance.
We can’t award compensation or provide advice on making a claim.
How much might a claim cost?
The judge considers the circumstances, including the seriousness of the breach and its impact. The court can also award legal costs for or against a party in some circumstances. There is no single figure in this guidance that prices a particular claim.
Ask the adviser about the strength of the claim, response dates, options for resolving it and the likely legal costs. Keep the proposed payment separate from the cost of handling the matter. If you have insurance, check the policy’s notification and consent terms before agreeing a settlement.
What to do
- Identify whether the message is a complaint, a demand for payment or court papers.
- Log the complaint and follow the required acknowledgement and response process.
- Keep the relevant records together for review.
- Ask a legal adviser about the claim, applicable deadlines, settlement options and costs.
Common questions
Can the ICO order compensation?
No. The ICO cannot award compensation. The organisation may agree to pay, or the person may take a claim to court.
Can distress count without financial loss?
The ICO explains that damage can be financial loss or distress. The court considers the circumstances of the claim.
Does an ICO opinion settle the court case?
No. The court makes its own decision and may disagree with the ICO’s opinion.
Where next
Sources
- ICO, Can I take legal action against the organisation?, checked 7 October 2026
- ICO, Taking your case to court and claiming compensation, checked 7 October 2026
- ICO, How to deal with data protection complaints, checked 7 October 2026
This is an independent editorial guide, not legal advice.