Two people were in the same breach. Same company. Same week. The first submits a claim form with their name, email address, and a brief description of what happened. The second submits a folder: the breach notification email, bank statements with three fraudulent transactions highlighted, a four-month distress journal, a GP note, and a scan showing their data listed on 60 data broker sites. The first receives £500. The second receives £5,000.
The gap between those outcomes is almost entirely about documentation. Your solicitor can only argue what you can prove. Your claim’s value depends on evidence of harm — financial, emotional, and reputational — and evidence of how far your data spread. This guide walks through exactly what to gather, how to organise it, and where a data broker scan fits into the picture.
This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation.
The short answer: To document a data breach claim, build a contemporaneous evidence file the day you learn of the breach. Gather five things: proof you were in the breach (notification email, Have I Been Pwned result), financial harm (statements, receipts, time logs), distress evidence (a dated journal, a GP note, a witness statement), a record of where your data has spread, and all correspondence with the company. Organise it into clear folders. The stronger the file, the larger the claim.
The evidence file that changes your claim
Most people hear about a breach and do one thing: change their password. Then they move on. Six months later, when they want to pursue compensation, they’re trying to reconstruct a timeline from memory — and courts don’t accept memory.
The evidence that supports a compensation claim needs to be contemporaneous. That means gathered at the time the harm occurred, not assembled months later. A bank statement you print today showing transactions from last spring looks different to a solicitor than statements you flagged and saved the week it happened.
Start building your evidence file the day you learn of the breach. Every hour you wait is evidence that degrades.
The core documents: start here
These five items are the foundation of any data breach claim. They establish that you were in the breach, what was exposed, and when you became aware.
The breach notification email. Don’t just read it — screenshot it with the full sender address visible, forward it to a dedicated folder, and save it. This is your primary record of when the company told you.
The company’s public breach acknowledgment. Find the official statement on their website, newsroom, or press release. Screenshot the page with the URL and date visible in the browser bar. Companies sometimes quietly update or remove these pages.
HaveIBeenPwned confirmation. Go to haveibeenpwned.com, enter your email, and screenshot the result if it shows your email in the relevant breach — including the breach description showing what data types were exposed. This is independent third-party confirmation.
Subsequent phishing attempts or fraud contact. If you receive suspicious emails, calls, or texts after the breach, screenshot and save them. These establish that your data is already being used.
Your communications with the company. Every email you send to the company asking about the breach, and every response they give, goes into a folder. If you called their helpline, note the date, time, and what you were told.
Financial harm evidence
Financial harm is the easiest category to document and often the most persuasive. Gather these even if the amounts seem small — they add up and they establish a pattern.
Bank and card statements. Pull six months of statements covering the period after the breach. Highlight every transaction you didn’t authorise. Note when you reported each one and how the bank responded.
Receipts for services you purchased in response. If you signed up for a credit monitoring service, an identity protection service, or a credit report after the breach, keep the receipts. These are direct consequential costs.
Professional invoices. Solicitor, accountant, credit repair — any professional you paid to help resolve the aftermath. Keep the invoices and evidence of payment.
Time logs. This one surprises people. UK courts accept a claim for time spent resolving the consequences of a breach, typically valued at £15–£25 per hour. Keep a dated, specific log: “04/03/2026 — 2.5 hours: called HDFC fraud line, disputed three transactions, visited branch to sign fraud declaration.” Vague entries (“spent time sorting out the bank situation”) carry less weight than specific ones.
Lost earnings. If you took time off work to deal with the breach — attending appointments, making calls, handling bank disputes — document it. Payslips showing the deduction or a letter from your employer confirming the absence.
Distress evidence — the category most people miss
Under GDPR Article 82 and equivalent legislation, you can claim for non-material damage: anxiety, distress, and loss of enjoyment of life caused by the breach. Courts have awarded significant sums on distress grounds alone, particularly where the breach involved sensitive categories of data.
The key is that the distress needs to be documented, not just described.
Start a journal the day you learn of the breach. Write an entry dated that day. Record what you’re feeling — fear about how your data might be used, anxiety about your finances, worry about identity theft. Then keep writing. Date every entry. Be specific and honest about the impact on your daily life: sleep, relationships, concentration at work. Courts detect exaggeration and it damages your credibility. Write what’s genuinely true.
See your GP if the anxiety is real. If the breach is causing you genuine distress, make an appointment and mention it explicitly. A GP record noting that you presented with anxiety following a data breach carries real evidential weight. This isn’t about manufacturing evidence — it’s about ensuring genuine harm is on the record.
A witness statement from someone close to you. Ask a family member or close friend to write a brief, signed statement. It should describe changes they observed in your behaviour or wellbeing after you told them about the breach. “She was checking her bank account three times a day and couldn’t sleep for weeks” is evidence. Keep it short, specific, and genuinely observed.
For a full breakdown of what courts accept as distress evidence in data breach claims, see our guide on GDPR non-material damage.
How does data broker exposure prove downstream harm?
Here’s something most claimants don’t know: when a company is breached, your data doesn’t stay at that company. It spreads. It moves to data brokers, people-search sites, and dark web marketplaces. The breach is the event; the proliferation of your data is the ongoing harm.
A scan showing your personal data listed across dozens of data broker sites, taken shortly after you became aware of the breach, documents that the breach caused your data to proliferate beyond the breached company. This establishes downstream harm. Your name, phone number, address, and other details are now indexed and available on sites that sell data to telemarketers, scammers, and anyone willing to pay.
Walk through an example exposure report to see the kind of documentation a scan produces, and take a dated screenshot when you run your own. Note which sites list your name, phone, and address. If you have prior scan results from before the breach, compare them — any new listings that appeared after the breach date are particularly useful evidence. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.
This evidence is directly relevant to the extent of harm argument in your claim. It shows that the breach had consequences beyond the initial incident, that those consequences are documented, and that your data’s exposure is ongoing.
Organising your evidence file
Don’t pile everything into one folder and hope your solicitor can make sense of it. A well-organised file signals a well-prepared claimant — and saves expensive solicitor time.
Folder 1 — Breach confirmation: notification email, HIBP screenshot, company’s public statement, any press coverage of the breach.
Folder 2 — Financial harm: bank statements with fraud highlighted, credit card statements, receipts for monitoring services, professional invoices, time log, lost earnings evidence.
Folder 3 — Distress evidence: journal entries (print and sign each page), GP records, witness statement.
Folder 4 — Data exposure: data broker scan screenshots with dates, dark web monitoring alerts, any evidence of your data appearing where it shouldn’t.
Folder 5 — Correspondence: all communications with the company, in date order. Include any complaints you filed with the ICO.
Keep digital copies and physical copies of anything you can’t replace. A cloud backup of your documents folder, plus a printed copy of the most important items, is a reasonable approach.
When you have enough to approach a solicitor
You don’t need a perfect file before making contact. No-win-no-fee solicitors specialising in data breach claims will assess what you have in an initial consultation — and they’ll tell you what would strengthen the case.
The minimum that’s usually worth bringing to a first conversation: the breach notification, HIBP confirmation, and at least one category of documented harm (financial or distress). That’s enough for a solicitor to assess viability.
If you have all five folders above, you’re in a strong position. That level of documentation is what turns a baseline settlement into a properly argued claim.
For guidance on finding a specialist solicitor and understanding how no-win-no-fee arrangements work, see our post on finding a data breach solicitor.
Frequently asked questions
What evidence do I need for a data breach claim? Proof you were in the breach (notification email, Have I Been Pwned result), plus evidence of harm. Harm can be financial (statements, receipts) or emotional (a dated distress journal, a GP note). A record of where your data has since spread also helps.
Can I claim for distress alone, with no financial loss? Yes, under GDPR Article 82 and equivalents. Document it with a dated journal, a GP record, and a witness statement. Courts award for genuine, documented distress, so don’t exaggerate.
When should I start gathering evidence? The day you learn of the breach. Contemporaneous evidence carries far more weight than a timeline reconstructed months later from memory.
Do I need a complete file before contacting a solicitor? No. Bring the breach notification, a Have I Been Pwned confirmation, and one documented category of harm. A no-win-no-fee solicitor can assess viability and tell you what to add.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.