# A data breach compensation claim: what should businesses know? Separate the complaint, the request for payment and any court action before deciding what help you need. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md). **The short answer.** A person can seek compensation for damage caused by an organisation breaking UK data protection law. That can include financial loss or distress. A claim is not an automatic award: an organisation may agree to pay, or a court may decide the case. The ICO cannot award compensation ([ICO, Can I take legal action against the organisation?](https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/) and [ICO, Taking your case to court and claiming compensation](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/), checked 7 October 2026). ## Is this a complaint or a compensation claim? Ask what the person wants you to do. They may want an explanation, a change to how data is handled, payment, or several of these. Keep those requests clear in your response. You must provide a way to make a data protection complaint and acknowledge it within 30 days. You must then take appropriate steps to respond, make enquiries, keep the person informed and give the outcome without undue delay. That acknowledgement period is not a general deadline for answering court papers ([ICO, How to deal with data protection complaints](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/), checked 7 October 2026). **Separate the routes before responding** | Route | What it can do | | --- | --- | | Complaint to the organisation | Requires a complaint process, acknowledgement and a response. | | Complaint to the ICO | The ICO may give a view, but it cannot award compensation. | | Agreed payment | The organisation and person may settle without a court claim. | | Court claim | The court decides the case and any award; its view may differ from the ICO’s. | Source: ICO, Can I take legal action against the organisation?, https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/ (checked 7 October 2026); ICO, Taking your case to court and claiming compensation, https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/ (checked 7 October 2026); ICO, How to deal with data protection complaints, https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ (checked 7 October 2026) ## What does the person need to show? The compensation question is about damage caused by a breach of data protection law. The ICO’s guidance includes lost money and distress. Do not assume that every incident leads to the same claim or amount ([ICO, Can I take legal action against the organisation?](https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/) and [ICO, Taking your case to court and claiming compensation](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/), checked 7 October 2026). For a useful first review, gather the claim letter, the relevant data records and the account of what happened. Ask the legal adviser to separate the alleged breach, the claimed harm and the evidence linking them. **Read the claim in parts** 1. The alleged breach: Which use of personal data is being challenged? 2. The claimed damage: What loss or distress is described? 3. The evidence: How is that damage linked to the alleged breach? This is a way to organise the review, not a decision on whether the claim succeeds. Source: ICO, Can I take legal action against the organisation?, https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/ (checked 7 October 2026); ICO, Taking your case to court and claiming compensation, https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/ (checked 7 October 2026) ## Does the ICO need to decide first? No. A person does not have to complain to the ICO, or wait for its decision, before pursuing a court claim. The court reaches its own decision and may disagree with the ICO’s view ([ICO, Can I take legal action against the organisation?](https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/) and [ICO, Taking your case to court and claiming compensation](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/), checked 7 October 2026). The ICO makes its limit clear in its public guidance ([ICO, Can I take legal action against the organisation?](https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/), checked 7 October 2026). > "We can’t award compensation or provide advice on making a claim." > ICO, Compensation guidance > ICO, Can I take legal action against the organisation?, https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/ (checked 7 October 2026) ## How much might a claim cost? The judge considers the circumstances, including the seriousness of the breach and its impact. The court can also award legal costs for or against a party in some circumstances. There is no single figure in this guidance that prices a particular claim ([ICO, Taking your case to court and claiming compensation](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/), checked 7 October 2026). Ask the adviser about the strength of the claim, response dates, options for resolving it and the likely legal costs. Keep the proposed payment separate from the cost of handling the matter. If you have insurance, check the policy’s notification and consent terms before agreeing a settlement. ## What to do 1. Identify whether the message is a complaint, a demand for payment or court papers. 2. Log the complaint and follow the required acknowledgement and response process ([ICO, How to deal with data protection complaints](https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/), checked 7 October 2026). 3. Keep the relevant records together for review. 4. Ask a legal adviser about the claim, applicable deadlines, settlement options and costs. ## Common questions ### Can the ICO order compensation? No. The ICO cannot award compensation. The organisation may agree to pay, or the person may take a claim to court ([ICO, Can I take legal action against the organisation?](https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/), checked 7 October 2026). ### Can distress count without financial loss? The ICO explains that damage can be financial loss or distress. The court considers the circumstances of the claim ([ICO, Taking your case to court and claiming compensation](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/), checked 7 October 2026). ### Does an ICO opinion settle the court case? No. The court makes its own decision and may disagree with the ICO’s opinion ([ICO, Taking your case to court and claiming compensation](https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/), checked 7 October 2026). ## Where next - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md) - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md) - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md) ## Sources - ICO, Can I take legal action against the organisation?: https://ico.org.uk/for-the-public/i-m-worried-an-organisation-hasn-t-kept-my-information-safe-what-should-i-do/can-i-take-legal-action-against-the-organisation/ (checked 7 October 2026) - ICO, Taking your case to court and claiming compensation: https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/ (checked 7 October 2026) - ICO, How to deal with data protection complaints: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.