An NHS employee accessed the medical records of hundreds of patients with no clinical reason — including records containing HIV diagnoses, mental health histories, and details of domestic abuse. None of those patients had a fraudulent bank charge. None of them had their identity stolen. Every one of them had a valid compensation claim. Several received awards between £2,500 and £5,000 for the distress of knowing their most sensitive health information had been seen by someone with no right to see it.
Most people who receive a data breach notification assume they don’t have a claim because nothing bad happened to their finances. That assumption is wrong.
This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation.
The short answer: Yes. Under GDPR Article 82, you can claim compensation for distress after a data breach, even with no financial loss. This is called non-material damage. UK courts have awarded £500 to £8,000+ for anxiety, lost sleep, and loss of control over your data. The C-300/21 ruling requires the harm to be real and documented, not just the fact of a breach. Your award depends heavily on evidence: a dated distress journal, a GP record, and proof of the impact on your daily life.
You don’t need a fraudulent charge to make a claim
The standard misconception is that data breach compensation requires a tangible financial crime. Think a fraudulent credit card charge, a loan taken out in your name, or money drained from an account. That’s one category of compensable damage. It’s not the only one.
UK GDPR Article 82, and its EU equivalent, explicitly provides for “material or non-material damage.” Non-material damage is the legal term for harm that doesn’t show up in your bank statement. Distress. Anxiety. Loss of sleep. The persistent awareness that strangers have access to information about you that you never consented to share. UK courts treat these as real, compensable injuries.
The question isn’t whether your distress qualifies in theory. The question is whether it meets the threshold courts have established — and whether you can document it.
What Article 82 says about non-material damage
Article 82(1) of UK GDPR (and EU GDPR) states: “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”
The phrase “non-material damage” doesn’t appear with a definition. Courts have filled in the meaning through case law. The foundational UK case is Vidal-Hall v Google [2015] EWCA Civ 311. The Court of Appeal held that distress damages are available under UK data protection law without any requirement to prove financial loss. The principle predates UK GDPR and is embedded in UK legal tradition.
If a company violated UK GDPR in a way that caused you genuine distress, you have a legal basis to claim for that distress alone. No bank fraud required.
The C-300/21 ruling: the standard you must meet
The European Court of Justice provided the clearest statement on the threshold in Case C-300/21 (UI v Österreichische Post AG), decided 4 May 2023. The case involved a data subject whose political party affiliation had been inferred and stored by a data broker, then shared without consent.
The CJEU confirmed that non-material damage under GDPR Article 82 is compensable. But it also drew a line: mere infringement of GDPR is not sufficient. The claimant must show actual negative consequences — “real and certain” damage they’ve experienced. A technical breach with no demonstrated impact on your life doesn’t automatically entitle you to compensation.
The ruling raises the bar from “something went wrong with my data” to “here is how it affected me.” That’s a meaningful distinction — but it’s achievable with proper documentation. Genuine anxiety about future harm from a serious breach crosses the threshold. What doesn’t: a brief moment of annoyance when a notification email arrived.
What have distress claims succeeded on?
UK courts and group action settlements have accepted the following as non-material damage:
Fear of future identity theft from a breach involving national identity data, passport numbers, or financial identifiers — particularly when the data appeared on the dark web. Even if no fraud has materialised, documented anxiety about its possibility qualifies.
Distress from medical data exposure. In NHS breaches involving mental health records, HIV status, or reproductive health information, courts have awarded at the higher end of the range. The sensitivity of the data amplifies the harm of unauthorised access.
Loss of sleep and concentration. Say a claimant documents disrupted sleep after a financial data breach, with journal entries and a GP visit referencing the breach as a stressor. Courts accept this as non-material damage.
Impact on personal relationships. Where the breach caused embarrassment, disclosure of private circumstances, or required difficult conversations with family members, courts have treated the relational harm as compensable.
What courts have rejected: “I was upset when I got the notification email” — stated without more. Courts detect exaggeration, and overclaiming damages an otherwise valid case.
How do you document your distress?
This is the most overlooked part of a UK data breach claim. Solicitors running group actions say it repeatedly: the difference between a £500 award and a £3,000 award is almost always documentation.
Start a contemporaneous journal the day you learn of the breach. Date every entry. Record the specific impact: difficulty sleeping, distraction at work, a conversation with a partner about the breach. Write like you’re describing events, not building a legal argument.
Visit your GP if you’re experiencing genuine anxiety, and mention the data breach as a contributing factor. A single entry in your medical record noting breach-related stress carries real evidentiary weight — medical records pre-exist the litigation, which makes them credible.
Keep records of specific consequences: time spent monitoring accounts, changing passwords, or setting up fraud alerts. If you paid for a credit monitoring service, keep the receipts.
Don’t exaggerate. Courts detect overclaiming, and it damages an otherwise valid case. Accurate documentation of moderate distress is worth more than embellished documentation of severe distress.
How much will you likely receive?
UK award ranges for non-material damage depend on the severity of impact and quality of evidence:
Minimal impact (£500–£1,000): No GP visit, no journal, no specific documented symptoms. Courts award at the low end when evidence is thin — but they do award something for genuine distress from a serious breach.
Moderate distress with documented impact (£1,500–£3,000): Journal entries, a GP visit, or records of disrupted sleep. The breach involved meaningfully sensitive data. This is the most common range in active group actions.
Severe distress with medical evidence or sensitive data (£3,000–£8,000+): Medical records documenting anxiety, evidence of ongoing impact, and/or a breach of particularly sensitive categories — health data, sexual orientation, biometrics. NHS mental health record cases typically settle here.
Group actions place claimants into tiered settlement bands based on evidence of distress. Higher-evidence claimants receive more. The documentation process is not bureaucratic box-ticking. It directly determines your outcome.
Frequently asked questions
Can I claim for distress alone after a data breach? Yes. GDPR Article 82 covers non-material damage, which includes distress and anxiety with no financial loss. Vidal-Hall v Google confirmed this in UK law.
What does the C-300/21 ruling require? The harm must be real and certain, not just the fact that a breach happened. Genuine, documented anxiety from a serious breach clears the bar. A moment of annoyance at a notification email does not.
How much can I get for distress? UK awards run roughly £500–£1,000 for minimal impact, £1,500–£3,000 for documented moderate distress, and £3,000–£8,000+ for severe distress or sensitive data like health records.
How do I prove distress? Keep a dated journal from the day you learn of the breach, see your GP and mention it, and record specific consequences. Don’t exaggerate, as courts detect overclaiming. See our GDPR compensation claims guide for the full process, and check where your data has spread to people-search sites.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.