Privacy Breach: What It Means and What to Do

In 2021, Clearview AI was using a database of over 30 billion face images. It scraped them from social media and the public internet, without consent from a single person photographed. It sold access to law enforcement agencies in multiple countries where that was flatly illegal under existing privacy law. No system was hacked. No password database was stolen. There was no breach in the technical sense that generates news coverage. There was, however, a privacy breach on a scale that dwarfs most of the hacks that do make headlines.

This is the gap in public understanding that causes real harm: “data breach” and “privacy breach” get treated as synonyms, but they’re not. A data breach is one type of privacy breach. The others — internal misuse, regulatory violations, physical exposure, illegal disclosure — receive far less attention. They are often harder to detect and harder to remedy. Yet they are equally damaging to the people affected.

This guide covers the full picture: what privacy breaches actually are, what harm they cause, and what the law gives you as tools when it happens to you.

The short answer: A privacy breach is any incident affecting the confidentiality, integrity, or availability of your personal data. It’s broader than a hack. It also covers internal misuse, unlawful data sharing, regulatory violations, and physical exposure like a lost laptop. The harm ranges from identity and financial fraud to reputational damage, physical-safety risk, discrimination, and pure distress. Under GDPR you have rights to notification, access (a Subject Access Request), complaint, and compensation, including for distress alone.

In this article:

What does “privacy breach” actually mean?

The UK Information Commissioner’s Office (ICO) has a definition. A personal data breach is “a security incident that has affected the confidentiality, integrity or availability of personal data.” That covers more ground than most people assume. You don’t need a hacker or malware. The breach can be entirely internal.

There are five categories worth distinguishing:

Technical (the “data breach”): Unauthorised external access to systems — the type that generates headlines. A criminal group exfiltrates a database of customer records. Ransomware encrypts a hospital’s patient files after data has already been copied out. This is what most people picture when they hear “breach.”

Organisational: Internal misuse by people with legitimate system access. NHS staff improperly looking up patient records for personal reasons — either curiosity or sale. DVLA employees selling vehicle keeper data to private investigators who then sold it to people tracking ex-partners. The NHS has published audit data showing thousands of inappropriate access incidents across trusts each year. The employees had authorised access; what they did with it was not authorised.

Contractual: A company shares your data with a third party in ways that exceed their stated privacy policy or your actual consent. Your medical insurer shares your health data with a life insurer when you never agreed to that. Or a marketing platform sells your browsing data to a political campaign, when their privacy policy only described “analytics partners.” This is common and frequently illegal. It rarely comes to victims’ attention until regulatory action uncovers it.

Regulatory: Processing your data in ways that violate applicable law — GDPR, UK GDPR, CCPA, India’s DPDPA — even without any disclosure to outsiders. The Meta €390 million fine issued by Ireland’s Data Protection Commission (DPC) in January 2023 is the clearest recent example. Meta was forcing users to accept behavioural advertising as a condition of using Facebook and Instagram. It treated “contract performance” as the legal basis for processing that was really just commercial tracking. No external breach. No hacker. A regulatory privacy breach at massive scale.

Physical: Documents left in bins, unencrypted laptops lost on trains, confidential files sent to the wrong fax number. This still happens, and it still causes serious harm. An NHS trust had an unencrypted laptop stolen from a staff member’s car; it contained years of patient data. The recovery effort, the regulatory response, and the patient impact were identical to what follows a technical breach — because the outcome is the same.

The reason this taxonomy matters: your response, your legal rights, and who you should contact differ depending on the type of breach. Say you file a complaint with the ICO about a technical breach. Then say you file one about a contractual disclosure by your employer to an insurer. Both go through the same authority, but they require different documentation.

What’s actually at risk: the harm taxonomy

Privacy breach coverage focuses heavily on the existence of the breach. What receives less attention is the specific pathway from breach to harm — which determines how serious any given breach actually is for you personally.

Identity fraud: Consider the combination of full name, date of birth, and a national ID number (SSN in the US, Aadhaar in India, National Insurance number in the UK). That is enough to open credit accounts, apply for loans, commit tax fraud, and claim government benefits in someone else’s name. These credentials are stable and don’t become useless when you “change your password.” Someone with your NI number and date of birth has a durable fraud tool. The harm shows up on credit files and tax records, sometimes years after the original breach.

Financial fraud: Payment card numbers and CVV codes can be monetised in hours — test transactions followed by larger purchases before the card is flagged. Bank account details and sort codes enable direct payment fraud and account takeover. Unlike identity fraud, financial fraud from card data tends to appear quickly and is usually covered by bank fraud protections, but the recovery process is slow and stressful.

Reputational and professional harm: Medical records, mental health records, sexual history, private communications — when these are exposed, the damage is personal. An employer might discover an employee’s mental health diagnosis from a breach of a therapy app’s database. They may never explicitly cite it. But research consistently shows stigmatising conditions affect employment decisions. Private messages taken out of context can damage relationships. This is harm even where no fraud occurs, and courts in the UK and Ireland have recognised it.

Physical safety: This category is underweighted in most breach discussions. A home address exposed to a domestic abuser who has been blocked on every platform is a life-safety issue. A database of residents at a domestic violence shelter is a target list. Location data from a stalker victim’s dating app profile, exposed through a privacy-violating API feature, has enabled physical harm in documented cases. Data protection law at its most consequential is not about spam email — it’s about whether someone can find you.

Discrimination: Health conditions, genetic data, political views, religious beliefs, union membership — these are “special category” data under GDPR for a reason. When they reach employers or insurers, adverse decisions follow. Consider a job applicant whose HIV-positive status was disclosed without consent. Or an insurance applicant whose genetic data was shared with an insurer against GDPR rules. Or a union member whose name appeared in data sold to their employer. All of these represent concrete, documentable harm that flows from a privacy breach.

Psychological harm: Courts in the UK and Ireland have accepted that distress alone — without financial loss or fraud — constitutes compensable damage under GDPR Article 82. Think of the loss of control over your personal information. The anxiety of not knowing what will be done with your data. The feeling of violation when private communications become public. These are real harms. Vidal-Hall v Google [2015] EWCA Civ 311 confirmed at Court of Appeal level that misuse of private information without material financial loss can found a civil damages claim. Lloyd v Google [2021] UKSC 50 addressed the scope differently but didn’t overturn the principle that non-material harm is compensable.

Recent documented cases across all categories

Technical — NHS 111 (August 2022): Advanced, the software provider for NHS 111 and other urgent care services, suffered a ransomware attack. It forced NHS 111 call handlers to revert to paper systems for several weeks. Patient data including NHS numbers and medical records was accessed. Patients experienced disrupted care coordination. Advanced was later fined £6.09 million by the ICO — one of the largest fines issued to a health sector processor rather than a controller.

Organisational — DVLA employee data sales: Investigations have documented DVLA employees selling vehicle keeper data (names and addresses linked to registration plates) to private investigators. Those investigators in turn sold it to people tracking ex-partners and other targets. The data was legitimately accessible to the employees. The sale was not. Multiple prosecutions followed under the Data Protection Act.

Regulatory — Meta €390 million fine (DPC, January 2023): The Irish Data Protection Commission examined Meta’s behavioural advertising. It found Meta had processed users’ personal data under an invalid legal basis. This had continued since GDPR came into force in 2018. This was not a breach in the technical sense. It was years of systematic data processing in violation of GDPR’s requirements for a valid lawful basis. That processing affected hundreds of millions of people across the EU.

Contractual/Biometric — Clearview AI: Clearview scraped over 30 billion face images from publicly accessible websites and social media without consent. It built a biometric database and sold access to law enforcement agencies. Multiple EU data protection authorities and the UK ICO have found this to be unlawful under GDPR. Italy’s Garante fined Clearview €20 million. The UK ICO issued a £7.5 million fine (later reduced on appeal, with litigation ongoing). The Canadian and Australian privacy commissioners also found Clearview in breach of their respective laws. No database was “hacked” — the breach was the collection itself.

Physical — NHS unencrypted laptop theft: Multiple NHS trusts have been fined or issued enforcement notices following laptop thefts where patient data was not encrypted. In one case, a laptop left in a staff member’s vehicle contained records of over 1,000 patients including diagnoses and contact details. Encryption would have made the theft irrelevant from a data protection perspective. The failure to encrypt was the breach.

Legal rights when a privacy breach affects you

Rights vary by jurisdiction. The picture is summarised below, then broken down.

Right to notification. Under GDPR Article 33, controllers must notify their supervisory authority within 72 hours of discovering a breach. Article 34 requires them to notify affected individuals “without undue delay” when the breach is likely to result in high risk to their rights and freedoms. In practice, individual notification is often delayed significantly — see the gap between when companies know and when individuals are told. You are not legally guaranteed to receive a notification for every breach that involves your data.

Right to access information. Under GDPR Article 15 (UK GDPR equivalent), you have the right to submit a Subject Access Request (SAR) to any organisation processing your personal data. They must tell you what data they hold, where it came from, who it has been shared with, and on what legal basis it is being processed. If you suspect a privacy breach involving your data, an SAR is often the first tool to reach for.

Right to compensation. GDPR Article 82 grants any person who has suffered material or non-material damage as a result of a GDPR infringement the right to receive compensation. The key 2023 CJEU ruling in UI v Österreichische Post (Case C-300/21) confirmed that non-material damage is compensable, including distress, anxiety, and loss of control. But it must be real and certain, not hypothetical. Companies bear the burden of proving they were not responsible once you establish the damage.

In India, the DPDPA 2023 does not include a direct individual compensation mechanism equivalent to Article 82. Aggrieved individuals can file complaints with the Data Protection Board, which can impose penalties on data fiduciaries. But the compensation pathway for individuals is less direct than under GDPR.

In the US, compensation rights depend on state law and the specific sector. HIPAA doesn’t give individuals a private right of action. You can file a complaint with the HHS Office for Civil Rights, but HIPAA enforcement action goes to the government, not to you. CCPA gives California consumers limited private rights of action for data breaches involving certain categories of data. Class action litigation is the primary vehicle for US compensation.

Right to complain. Every jurisdiction covered by GDPR and UK GDPR has a designated supervisory authority. Filing a complaint triggers a formal investigation. Even if you personally don’t receive compensation through the complaint process, investigations can lead to enforcement action and fines that have deterrent effect. Supervisory authorities:

UK: Information Commissioner’s Office — ico.org.uk/make-a-complaint
Ireland: Data Protection Commission — dataprotection.ie
France: Commission Nationale de l’Informatique et des Libertés (CNIL) — cnil.fr
Germany: Each federal state has its own DPA; the Federal Commissioner for Data Protection (BfDI) handles federal matters — bfdi.bund.de
Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
India: Data Protection Board (operational status being phased in under DPDPA 2023)
US Federal: Federal Trade Commission — reportfraud.ftc.gov (no single privacy supervisory authority, but the FTC handles unfair or deceptive data practices)

For EU-wide strategic litigation — particularly against large tech companies — NOYB (noyb.eu), founded by Max Schrems, files complaints simultaneously across multiple EU jurisdictions. Filing with NOYB for systematic violations is an option where individual country complaints are unlikely to be prioritised.

What to do: a step-by-step response

This section is for someone who has just found out a privacy breach involved their data. Work through it in order.

Immediate (first 24 hours)

1. Confirm the breach is real before taking action. Go to the organisation’s own website — not through any link in the notification email. Check their newsroom or security page. Search for independent press coverage. Check haveibeenpwned.com for your email address. Breach notification emails are a known phishing vector; attackers send fake notifications following real high-profile breaches to harvest credentials.

2. Change credentials for the affected service. Use a unique, random password — not a variation of your existing one. If you’ve used the same password elsewhere, change those too. Credential stuffing — automated attacks using stolen username/password pairs against hundreds of sites — begins within hours of a breach being listed for sale.

3. Enable two-factor authentication if it is not already active. An authenticator app (Aegis, Google Authenticator, Authy) rather than SMS where possible. SMS 2FA is vulnerable to SIM swap attacks.

4. If financial data was involved: contact your bank immediately. Request proactive card replacement — don’t wait for fraudulent charges to appear. Review the last 90 days of transactions for micro-test charges you may have missed.

5. If your address or location was exposed to someone who poses a danger to you: Contact police immediately. Domestic abuse services in your jurisdiction can also advise on practical protective steps. This is a safety issue before it is a data protection issue.

Within the first week

6. Submit a Subject Access Request. Write to the organisation’s Data Protection Officer. Ask for confirmation of what personal data of yours was involved in the breach. Ask who it was shared with, before and after. Ask what remediation steps they have taken. UK GDPR Article 15 gives you this right, and they must respond within one month.

7. File a complaint with the relevant supervisory authority. Use the links above for your jurisdiction. Include your name and contact details, and the same for the organisation. Add a description of the breach and when you became aware of it. State what harm you have suffered or are concerned about. Attach any correspondence you’ve had with the organisation. The more specific and documented your complaint, the more useful it is to investigators.

8. Document everything now. Keep copies of the breach notification (if you received one), any subsequent communications from the organisation, and evidence of fraudulent transactions or unusual account activity. Also write an account of how the breach has affected you: any distress, sleep disruption, anxiety, or changes in behaviour around using the internet or sharing personal information. For any future compensation claim, contemporaneous notes carry more weight than recollections written months later.

9. If national ID data was exposed:

UK (NI number): Place a CIFAS protective registration at cifas.org.uk. Contact HMRC if you suspect employment or tax fraud using your number.
US (SSN): Place a credit freeze at all three bureaus (Equifax, Experian, TransUnion) at annualcreditreport.com — a freeze, not just a fraud alert. Get an IRS Identity Protection PIN at irs.gov/identity-theft-central.
India (Aadhaar): Lock biometric authentication at uidai.gov.in immediately. Verify your linked mobile number. Alert your bank.

For compensation (UK and EU)

10. Assess your damage. Material damage: financial fraud losses, fees paid to rectify identity theft, time and cost of credit repair. Non-material damage: distress, anxiety, loss of sleep, loss of control over personal information, changes in daily behaviour. Both are compensable under GDPR Article 82. The CJEU’s C-300/21 ruling requires real harm, not hypothetical risk — your documentation from step 8 is what establishes this.

11. Send a Letter Before Action. Before filing a court claim, write to the organisation’s Data Protection Officer. State the breach, the GDPR infringement, your harm, the compensation you are seeking, and a deadline (14–30 days). Keep it factual. This letter creates the paper trail required before civil litigation and often triggers a settlement offer.

12. File in the Small Claims Court for claims up to £10,000 (UK). Use Money Claim Online at gov.uk/make-court-claim-for-money. Filing fees range from £35 to £455 depending on claim value. No lawyer required. If you need a detailed guide on this process, see claiming GDPR compensation.

13. For larger claims or group actions: engage a specialist solicitor. Data breach solicitors in the UK routinely work on conditional fee (no-win-no-fee) agreements. You pay nothing if you lose; they take a percentage if you win. Active group actions — British Airways, Marriott, various NHS trusts — are listed on law firm dedicated claim pages. Check Hayes Connor, JMW Solicitors, and Keller Postman UK for current cases.

Reducing your exposure going forward

No post-breach response fully neutralises the exposure. The data is out. The more useful goal is reducing what there is to expose and detecting future incidents faster.

Data minimisation as protection. The less you provide when organisations ask, the less they can lose. When a form asks for your date of birth and you don’t know why they need it, asking is legitimate. When a service asks for your address for a digital product, a fake or forwarding address preserves your real location. When a site wants your phone number “for account security,” an alias number (Google Voice, a temporary SIM) limits what a breach can expose.

Monitor your existing exposure. Register your email addresses at haveibeenpwned.com for free breach alerts. The service indexes new breach dumps and notifies you when your address appears — often before any corporate notification. For broader monitoring, dedicated dark web monitoring services scan criminal marketplaces for your credentials, phone numbers, and financial data.

Remove your data from people-search and data broker sites. When breach data circulates, attackers use data broker sites to find current contact details for targets. Your leaked email from 2019 is only useful if someone can still find your current phone and address. Removing yourself from these sites breaks that enrichment step. Guides for US brokers (/blog/remove-yourself-from-us-data-brokers/) and the Indian internet (/blog/removing-your-data-from-indian-internet/) walk through the process.

Use email aliases and phone masks for new services. With an alias per service, spam or phishing to that alias tells you exactly which service’s breach produced it. You can then kill the alias without changing your real email. Services like SimpleLogin, AnonAddy, and Apple’s Hide My Email provide this.

The Clearview pattern isn’t exceptional

The Clearview AI case is useful to keep in mind as a reference point. It illustrates that scale and impact are not limited to technical breaches. The company didn’t break into anything. The breach was in what they collected — systematically, at enormous scale, without any form of consent.

The same pattern applies to the Meta advertising case: the “breach” was years of processing that was never lawful, affecting hundreds of millions of people across the EU. No attacker. No stolen database. A regulatory privacy breach that GDPR was specifically designed to prevent.

Understanding privacy breach as a category broader than hacking changes what you look for and what you report. Say you learn a company has been sharing your health data with partners you never consented to. Or you discover an employer is monitoring personal communications beyond what any employment contract permits. Those are privacy breaches. You have the same complaint rights and the same access to compensation as someone whose credit card number was stolen.

The law covers all of it. Most people just don’t know that.

Frequently asked questions

What is a privacy breach? It’s any incident affecting the confidentiality, integrity, or availability of your personal data. That’s broader than a hack. It includes internal misuse, unlawful data sharing, regulatory violations, and physical exposure like a lost, unencrypted laptop.

Is a privacy breach the same as a data breach? No. A data breach (a hack or leak) is one type of privacy breach. The others (internal misuse, contractual over-sharing, regulatory violations, physical loss) are often harder to detect but equally damaging.

What rights do I have after a privacy breach? Under GDPR you have several rights: notification, access to your data via a Subject Access Request, and a complaint to a supervisory authority. You also have a right to compensation under Article 82, including for distress alone.

Can I get compensation for distress without financial loss? In the UK and EU, yes. GDPR Article 82 covers non-material damage. The C-300/21 ruling requires the harm to be real and documented. See our GDPR compensation guide.

What’s the first thing to do after a privacy breach? Confirm it’s real via the company’s own site (not the email link), then change the affected password everywhere you reused it and enable two-factor authentication. If your address reached someone dangerous, contact police first.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.