GDPR Compensation Claims: What You Can Win

This article is for educational purposes only and does not constitute legal advice. For advice specific to your claim, consult a qualified solicitor or data protection lawyer.

The right most breach victims never use

GDPR Article 82 states it plainly: “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”

No minimum threshold. No requirement to prove financial loss. No need to have had your bank account emptied or your credit destroyed. If a company broke GDPR rules and you suffered genuine distress as a result, you have a legal right to compensation.

Yet most breach victims in the UK and EU never claim a penny.

The reason isn’t eligibility. Tens of millions of people across the UK and EU have had their data exposed in breaches that involved clear GDPR violations — inadequate security, late notification, unlawful processing. A significant proportion of them experienced genuine anxiety, loss of sleep, or loss of control over their personal information. That’s compensable damage under Article 82.

The reason is awareness. People don’t know the right exists. And those who do know often assume claiming is too complicated, too expensive, or too uncertain. This guide addresses all three assumptions directly.

The short answer: Under GDPR Article 82, you can claim compensation for distress alone, with no financial loss required, if a company broke GDPR and caused you genuine harm. UK awards typically run £500–£3,000 for moderate distress and £5,000+ for sensitive data. To claim, prove four things (you were in the breach, your data was exposed, the company was at fault, and you suffered damage), then send a Letter Before Action and use Small Claims or a no-win-no-fee solicitor. Document your distress from the moment you learn of the breach.

In this article:

The legal text is short. The implications are substantial.

“Material damage” means direct financial harm. Fraud losses from someone using your stolen card details. Credit repair costs. Professional fees to sort out identity theft. If you can show a financial loss that flowed from the breach, that’s recoverable.

“Non-material damage” is where most UK and EU breach victims have their strongest case. Distress, anxiety, loss of sleep, fear of future identity theft, the psychological impact of losing control over your personal information — all of this qualifies. You don’t need a psychiatric diagnosis. Courts have accepted evidence as simple as a claimant’s written account of how the breach affected their daily life.

The critical qualifier here is the CJEU ruling in UI v Österreichische Post (Case C-300/21, 2023). The Court of Justice of the European Union confirmed that non-material damage is compensable under Article 82 — but also confirmed that merely being in a breach isn’t enough. The claimant must show real and certain harm. Genuine distress, documented anxiety, or actual impact on daily life clears that bar. Abstract worry that someone might misuse your data in the future does not.

“Infringement of this Regulation” means the company must have actually broken GDPR. Inadequate security measures. Failure to notify affected individuals within the required 72-hour window. Storing data longer than necessary. Unauthorised disclosure to third parties. A successful ICO or DPA enforcement action against the company is strong evidence of this element — courts give it significant weight.

On burden of proof: the claimant proves the damage and its connection to the infringement. The company must then prove it was not responsible for the damage. This reversal — placing the burden on the company rather than the victim — is one of the most powerful features of Article 82.

What have UK courts actually awarded?

The British Airways breach in 2018 exposed payment card details for around 500,000 customers. The data was stolen because BA’s website had been compromised with card-skimming malware — a straightforward GDPR security failure. Group litigation followed. BA settled the majority of individual claims at approximately £2,000–£6,000 per claimant, with the amount varying based on the documented level of distress and the sensitivity of the data exposed.

The Marriott International breach — also from 2018, disclosed in late 2018 — involved 339 million guest records globally, including significant numbers of UK data subjects. UK group litigation is ongoing, with similar compensation expectations.

NHS data breach cases have produced awards in the £750–£3,000 range for distress arising from inappropriate disclosure of medical records. These cases are instructive because medical data attracts higher compensation. It falls under GDPR’s “special category” data provisions. And the harm is almost entirely non-material: the claimants hadn’t lost money, but they’d had deeply private health information exposed without consent.

HMRC contractor data loss cases have produced awards in the £750–£2,500 range.

As a rough working guide: moderate distress from a standard data breach (name, email, phone, address) typically attracts £500–£3,000 in individual proceedings. Severe, documented distress, or breaches involving sensitive data — medical records, sexual orientation, financial information — can attract £5,000 or more. Courts use the Judicial College Guidelines for personal injury as a reference framework when assessing distress severity.

These aren’t hypothetical numbers. They’re the outcomes that have emerged from UK litigation since 2018.

What qualifies: the four elements you need

To bring a successful GDPR compensation claim, you need to establish four things.

1. You were in a breach. This is usually the easiest element. Evidence includes: the company’s direct notification to you, a listing on Have I Been Pwned (haveibeenpwned.com), an ICO enforcement decision naming the breach, or credible news reporting. You don’t need to have received a notification — companies routinely fail to notify individuals even when legally required to do so.

2. Your personal data was exposed. You need to know what data was involved. The company’s notification (if they sent one) should specify this. A Subject Access Request under Article 15 GDPR can compel the company to tell you exactly what data they held about you and what was compromised. Send one if you’re unclear.

3. The company was at fault. This means they breached GDPR — inadequate security is the most common ground, but failure to notify, unlawful processing, and data retention failures all count. ICO enforcement decisions are the strongest evidence here. If the ICO has found against the company, that finding will carry substantial weight in any civil claim you bring.

4. You suffered damage. Either financial harm (with documentation like statements, receipts, professional invoices) or genuine distress. Distress claims are the most common. Courts look for a real account of impact: how the breach affected your sleep, your anxiety levels, your daily routine, your sense of security. The C-300/21 ruling made this element non-trivial. Document it carefully.

For a detailed guide on how to gather and preserve evidence of harm, see how to prove harm after a data breach.

The claim process: step by step

Step 1: Send a Letter Before Action (LBA)

Before filing any claim, you must write to the company’s Data Protection Officer formally stating your case. The LBA should identify the breach, specify the GDPR infringement, describe the harm you suffered, and state the compensation you’re seeking. Give them a deadline, typically 14–30 days, to respond.

Keep this letter brief and factual. The purpose is to create a paper trail, demonstrate you attempted resolution before court, and give the company a chance to settle without litigation.

Template LBA (adapt as needed):
Dear Data Protection Officer,
I am writing to make a formal claim for compensation under Article 82 of the UK GDPR in connection with the data breach that occurred on or around [date].
My personal data — specifically [list data types: name, email address, payment card details, etc.] — was exposed as a result of [describe the breach]. This constitutes an infringement of the UK GDPR due to [inadequate security measures / failure to notify / other basis].
As a direct result of this breach, I have suffered [describe your damage: distress and anxiety, financial loss, etc.].
I seek compensation of £[amount] for the damage I have suffered. Please respond within 14 days of the date of this letter.
Yours sincerely, [Your name, address, contact details]

Step 2: File a complaint with the ICO

If the company rejects your claim, offers an inadequate settlement, or simply ignores you, file a complaint with the Information Commissioner’s Office at ico.org.uk/make-a-complaint. The ICO can investigate and issue enforcement findings. It cannot award you compensation directly — that requires a court — but an ICO finding against the company is powerful evidence in your civil claim.

Step 3: File in the Small Claims Court (for claims up to £10,000)

England and Wales: use Money Claim Online at gov.uk/make-court-claim-for-money. No lawyer required. Filing fees run from £35 to £455 depending on your claim value. The Small Claims process is designed for litigants in person — the court will not assume legal knowledge, and the procedures are manageable without professional representation.

Scotland and Northern Ireland have equivalent small claims procedures through their respective court systems.

Step 4: Engage a specialist solicitor for larger claims or group actions

For claims above £10,000 or where you want professional support at any level, specialist data breach solicitors handle these cases on a no-win-no-fee basis (a conditional fee agreement). You pay nothing if you lose; the solicitor takes a percentage of the award if you win. For a guide on finding and selecting the right firm, see finding a data breach solicitor on no-win-no-fee terms.

Group litigation vs individual claims

Individual claims work well for Small Claims Court cases. For larger amounts — or where you want the efficiency of pooled litigation against a major company — group actions are often the better route.

Currently active UK group actions include:

British Airways 2018 breach: group actions run by Hayes Connor Solicitors, JMW Solicitors, and Keller Postman UK, among others
Marriott International breach: ongoing UK group litigation
Various NHS Trust breaches: multiple firms handle these regionally
TikTok children’s data group action: relates to TikTok’s alleged unlawful processing of children’s data in the UK

To find current group actions for a specific company, search “[company name] data breach group action UK.” Active cases invariably have dedicated claim pages from the participating law firms. These pages include registration forms and eligibility criteria.

Group actions offer the advantage of shared litigation costs, pooled evidence, and often faster settlement — companies have stronger incentives to resolve at scale.

EU: the Collective Redress Directive

Since June 2023, qualified entities (typically consumer organisations and NGOs) across the EU can bring representative actions on behalf of data subjects under the Collective Redress Directive. This makes EU-wide group claims structurally viable for the first time. Individual Article 82 claims remain available in national courts across all EU member states.

If you’re in an EU country outside the UK, consult your national data protection authority for the specific court procedure and limitation period in your jurisdiction. The European Data Protection Board maintains a directory of national DPAs at edpb.europa.eu.

The C-300/21 ruling: what it means for distress claims

The CJEU’s 2023 ruling in UI v Österreichische Post (C-300/21) resolved a question that had circulated through European courts since GDPR came into force. Does mere exposure in a data breach give rise to compensable non-material damage?

The answer is no — but that’s the right answer.

The ruling confirmed that non-material damage must be real and certain, not hypothetical or merely possible. This raised the bar, but it didn’t eliminate distress claims. It redirected attention to evidence. Courts now focus on whether the claimant can demonstrate genuine psychological impact — not just the fact of exposure.

The practical implication is straightforward: document your distress from the moment you learn of the breach. Write down what you felt and when. Note conversations with your GP about anxiety or sleep disruption. Keep records of any impact on your daily routine — reluctance to use online banking, changed behaviour around personal information, difficulty concentrating. A contemporaneous written account is substantially more credible than a retrospective one produced for litigation purposes.

This evidence is what separates a marginal claim from a winning one. The C-300/21 ruling didn’t close the door on distress claims — it made documentation the deciding factor.

Limitation periods

UK: The limitation period for GDPR compensation claims is disputed at the margins. Claims framed as tort (the most common approach post-Brexit) carry a 6-year limitation period under section 2 of the Limitation Act 1980. Some defendants argue claims involving personal injury elements should be subject to the 3-year period under section 11. Courts have not fully resolved this, and the answer matters significantly for older breaches.

The safe approach: bring your claim within 3 years of the breach date. If you weren’t notified at the time, count 3 years from when you became aware of it. Don’t wait on the assumption you have 6 years; litigate this assumption at your peril.

EU: Limitation periods vary by member state, typically between 2 and 5 years. France is 5 years. Germany is 3 years. Ireland is 2 years from the date of knowledge. Check your national rules promptly — this is not an area where delay helps.

The breach that exposed your data may be years old. The clock is already running.

Frequently asked questions

Can I claim GDPR compensation without financial loss? Yes. Article 82 covers non-material damage like distress and anxiety. You don’t need a psychiatric diagnosis, but under the C-300/21 ruling the harm must be real and documented, not hypothetical.

How much is a GDPR claim worth? In the UK, moderate distress typically attracts £500–£3,000. Sensitive data (medical, financial) or severe distress can reach £5,000 or more. British Airways breach claimants settled around £2,000–£6,000.

How do I start a GDPR compensation claim? Send a Letter Before Action to the company’s Data Protection Officer. If ignored or rejected, complain to the ICO, then file in Small Claims Court (up to £10,000) or use a no-win-no-fee solicitor for larger claims.

How long do I have to claim? Bring your claim within 3 years of the breach (or of learning about it) to stay safe. Some argue for 6 years, but that’s unsettled. EU states vary from 2 to 5 years.

What evidence do I need? Proof you were in the breach, what data was exposed, that the company broke GDPR, and that you suffered harm. See our guide on how to prove harm after a data breach. A record of your data spreading to people-search sites helps show ongoing harm.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.