Data Breach Compensation: Your Legal Rights

This article is for educational purposes only and does not constitute legal advice. If you believe you have a claim, consult a qualified solicitor or attorney in your jurisdiction.

The company was fined millions. You got nothing.

Equifax paid at least $575 million to settle claims arising from the 2017 breach that exposed 147 million people’s data. Meta paid $725 million to settle the Cambridge Analytica class action. British Airways paid £20 million to the UK’s Information Commissioner’s Office after their 2018 breach exposed 400,000 customers.

Most of those victims received nothing. Or they got a $125 check — before the Equifax settlement fund ran dry and payouts dropped to pennies on the dollar.

Not because they had no rights. Because they didn’t know how to use them.

Regulators collect fines and move on. The money goes to governments, not to the people whose data was actually mishandled. The only way individual breach victims see compensation is by claiming it themselves. Companies count on the fact that most won’t bother. This guide covers what you’re actually owed and how to start the process.

The short answer: Your right to data breach compensation depends on where you are. Under GDPR Article 82 (EU/UK), you can claim for distress alone, with no minimum loss and often no upfront cost via no-win-no-fee. In the US, compensation comes through class actions, usually $25–$500 unless you document losses. In India, claims run through the IT Act’s Section 43A while the new Data Protection Board becomes operational. Everywhere, you must gather proof you were in the breach and file before the limitation deadline.

In this article:

The legal basis: where your right to compensation comes from

The right to claim compensation after a data breach exists in law across most major jurisdictions. The mechanisms differ, but the principle is the same: when a company fails to protect your data and you suffer harm as a result, you have a legal remedy.

GDPR Article 82 (EU) is the most powerful individual right in existence. Any person who suffers material or non-material damage as a result of a GDPR infringement has the right to receive compensation from the controller or processor. No minimum damage threshold. No requirement to prove financial loss. Distress, anxiety, and loss of control over personal data all qualify.

UK GDPR carries the identical provision post-Brexit, enacted through the Data Protection Act 2018. UK courts have awarded compensation for distress alone — without any accompanying financial loss — in multiple cases. The jurisdiction is actively litigated.

United States: there is no federal data breach compensation law equivalent to GDPR. Compensation comes through state consumer protection statutes, class action litigation, and FTC-mandated settlement funds. California, Illinois, and New York have the strongest individual rights. Illinois BIPA (Biometric Information Privacy Act) is notable — it provides statutory damages of $1,000–$5,000 per violation without requiring proof of harm.

India DPDPA 2023: Section 43A of the IT Act 2000 is India’s pre-existing compensation provision, which the DPDPA is replacing. It provides a route for compensation via Adjudicating Officers. The DPDP Rules were notified in November 2025, and the Data Protection Board of India was legally established. As of mid-2026, though, the Board is not yet fully operational, with leadership appointments still pending.

Australia: the Privacy Act 1988 allows individuals to lodge complaints with the Australian Information Commissioner, who has the power to award compensation and require remedial action.

What can you claim for: material vs non-material damage?

Claims fall into two categories. Understanding both matters, because one of them applies to almost every breach victim who suffered any kind of distress.

Material damage covers financial loss directly caused by the breach. Fraudulent transactions on accounts accessed using stolen credentials. Costs to repair your credit file. Professional fees to a solicitor, identity theft service, or accountant to sort out fraud committed in your name. Lost earnings if you took time off work to resolve identity fraud. Document these with receipts, bank statements, and records.

Non-material damage is where most breach victims underestimate their position. UK and EU courts have consistently held that exposure of personal data — without any proven financial loss — qualifies for compensation. The harm is the loss of control over your own information, the anxiety of not knowing who has it, and the distress of having private data circulating without your consent.

Awards in UK group actions for non-material damage typically range from £500 to £3,000 per person for standard distress. They rise significantly for ongoing harm, sensitive categories of data (health, financial records), or cases where the anxiety was severe and documented. In Lloyd v Google [2021] UKSC 50, the UK Supreme Court ruled against the claimants. It held that “mere loss of control” over personal data is not sufficient damage to sustain a representative action without proof of individual harm. The ruling significantly curtailed large-scale opt-out data protection claims in the UK.

For the detailed legal analysis of non-material damage under GDPR, see /blog/gdpr-non-material-damage/.

EU/UK: the strongest individual rights

GDPR Article 82 is directly enforceable. You do not need to wait for a regulator to act before bringing a claim. The steps:

Write to the company’s Data Protection Officer (every GDPR-covered organisation must have one or a designated contact). State what data was exposed, what harm you suffered, and that you are seeking compensation under Article 82. Give them a reasonable deadline — 30 days is standard.
If unsatisfied, complain to the national Data Protection Authority. In the UK that’s the ICO (ico.org.uk). In France it’s CNIL, in Germany each state has its own DPA. A regulator complaint puts the company on notice and creates a paper trail, even if the regulator doesn’t personally pay your compensation.
Bring a civil claim. You can take a case to court directly, or instruct a solicitor. In the UK, “no win no fee” data breach solicitors are actively running group claims against British Airways, Marriott, Capita, and NHS Trusts, among others. You register your interest, provide your evidence, and the firm handles the litigation — you pay nothing if the claim fails.

The EU Collective Redress Directive became available to member states from 2023, enabling representative actions where consumers can be grouped into a single claim across the EU. This lowers the barrier for coordinated action significantly.

US: class actions are the mechanism

Individual GDPR-style rights don’t exist at the federal level. The class action system is how breach victims in the US receive compensation collectively.

Here’s how it works. A plaintiff’s law firm files a class action lawsuit against the breached company. The court certifies a “class” — all people whose data was exposed in the breach. The company (usually) settles rather than going to trial. The settlement fund is distributed to class members after legal fees.

Typical per-person payouts: $25 to $500, depending on the settlement size and the number of claimants who submit claims. Some — the Equifax settlement, the T-Mobile settlement — offer more for individuals who document out-of-pocket losses. Illinois BIPA claims are different; statutory damages of $1,000 per negligent violation and $5,000 per intentional violation mean class settlements can be substantial even without documented harm.

To participate in an existing class action, you generally just need to submit a claim form before the deadline. Law firms publish claim portals when settlements are approved, and sites like TopClassActions.com aggregate open claims.

For the mechanics of joining or initiating a US data breach class action, see /blog/data-breach-class-action-guide/.

India: the right exists, enforcement is arriving

India’s DPDPA 2023 is ambitious legislation, but it does not create a direct individual right to compensation in the way GDPR does. The DPDPA’s penalty regime allows the Data Protection Board of India to fine companies. But those fines go to India’s Consolidated Fund (the government treasury), not to affected individuals. Privacy advocates have specifically criticised this gap.

The practical problem is timing. The DPDP Rules were notified in November 2025 and the Board was legally established. But as of mid-2026 the Board is not yet fully operational, with substantive obligations phasing in through 2026 and 2027.

In the interim, two paths exist. First, file a breach notification complaint with CERT-In (the Indian Computer Emergency Response Team). Companies must notify CERT-In within 6 hours of a breach, and failure to do so is itself a violation. Second, pursue civil remedies under Section 43A of the IT Act 2000, India’s pre-existing individual compensation mechanism. It allows compensation from companies that failed to implement “reasonable security practices and procedures” and caused wrongful loss or gain. These claims go to Adjudicating Officers appointed under the IT Act.

Once the DPBI is fully operational, it may create additional pressure on companies. But individual compensation for data breach victims is expected to remain primarily through the IT Act’s Adjudicating Officer mechanism for the foreseeable future.

For the India-specific compensation guide, see /blog/india-data-breach-compensation/.

What you need to make a claim

Across all jurisdictions, the evidence requirements follow the same pattern. Gather this before you contact anyone.

Evidence you were in the breach. The notification email from the company. A HIBP confirmation showing your email in the breach dataset. A statement from the company acknowledging the breach and your inclusion in it. You need at least one of these.

Evidence of what data was exposed. The company’s breach notice should list data categories — name, address, email, passport number, financial data. If they haven’t published a data inventory, submit a Subject Access Request (under GDPR/UK GDPR) or a CCPA data request (California) asking for confirmation of what categories of your data they held and whether it was involved in the breach. They are legally required to respond within 30 days.

Evidence of harm. For material damage: bank statements showing fraudulent transactions, receipts for costs incurred, records of lost earnings. For non-material damage: a written account of the distress you experienced — when you found out, how it affected you, any anxiety, loss of sleep, or behavioural changes. This doesn’t need to be a formal document; courts have accepted personal statements.

Evidence of downstream data spread. When your data appears in a breach, it doesn’t stay there. It propagates into data broker databases and people-search sites. A record of where your personal information now appears helps show it is circulating as a result of the breach. This establishes that the harm extended beyond the initial incident and is ongoing. That documentation is relevant to the harm element of your claim.

The limitation periods: time limits that matter

Claims have deadlines, and missing them ends your case regardless of its merits.

UK: 6 years from the date of the breach (or from the date you became aware of it, in some circumstances). For claims framed purely as personal injury — distress — the limitation is 3 years. Act before the 3-year mark to keep all options open.
EU: varies by member state. Typically 3 to 5 years. France: 5 years. Germany: 3 years. Check the rule in the country whose law governs your claim.
US: varies by state and cause of action. Most state consumer protection and data breach statutes carry 2 to 3 year limitations. Class actions are typically filed within months of a breach becoming public — if you see news coverage, check whether a class action has already been filed and join it before the opt-in deadline.
India: DPDPA limitation periods are to be set by the forthcoming rules. IT Act Section 43A civil claims: 3 years.

Joining an existing group action is almost always the easiest path — the firm has already done the work of establishing the breach, the class, and the legal theory. Your job is to register and document your own harm.

Finding legal help

Most data breach claims in the UK and EU are run on a no-win-no-fee (conditional fee agreement) basis. You pay nothing upfront and nothing if you lose. The solicitor takes a percentage of any compensation awarded — typically 25–35%. This means specialist firms take only cases they believe they can win, which is also a reasonable signal of claim viability.

UK firms actively pursuing data breach group actions include Hayes Connor Solicitors, JMW Solicitors, and Keller Postman UK. For NHS and public sector breaches, Slater and Gordon and Leigh Day have run significant actions.

US class action firms handling data breach litigation include Boies Schiller Flexner, Morgan & Morgan, and Milberg Coleman Bryson. These firms advertise on claim aggregator sites when they have open cases.

In Australia, the Australian Information Commissioner handles complaints directly — you do not need a lawyer to file with the OAIC, though one helps if the complaint escalates to formal investigation.

For guidance on choosing a data breach solicitor and what questions to ask before signing a no-win-no-fee agreement, see /blog/data-breach-solicitor-no-win-no-fee/.

Frequently asked questions

Am I entitled to data breach compensation? In the EU and UK, yes, under GDPR Article 82, if a breach caused you material or non-material harm (including distress). In the US, compensation comes through class actions and state laws. Your rights depend on where you live and which law governs the breach.

Can I claim without any financial loss? In the EU and UK, yes. Courts have awarded compensation for distress alone, typically £500 to £3,000. Lloyd v Google limits large opt-out group claims, but individual distress claims still stand.

How much can I get? UK/EU distress awards commonly run £500–£3,000, higher for sensitive data. US class-action base payouts are usually $25–$500 unless you document losses, which can reach $25,000. Illinois BIPA pays $1,000–$5,000 per violation.

Do I have to pay a lawyer upfront? Usually not. Most UK and EU breach claims run on a no-win-no-fee basis. You pay nothing if the claim fails; the solicitor takes 25–35% of any award.

How long do I have to claim? Limits vary: UK 6 years (3 for distress-only), most EU states 3–5 years, most US states 2–3 years, and India 3 years under the IT Act. File before the earliest applicable deadline.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.