This article is educational and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific claim.
Most people who were in a data breach receive the minimum settlement. Not because their harm was minor — but because they couldn’t prove it. They knew they felt anxious. They knew they’d spent hours on hold with their bank. They just didn’t write any of it down.
The gap between a £500 base amount and a £5,000 documented claim is not determined by the severity of the breach. It’s determined by what you can show.
The short answer: To prove harm in a data breach claim, document two kinds of damage. Material harm is money lost or spent: bank statements with fraudulent charges, receipts for monitoring, a time log, and professional invoices. Non-material harm is distress: a dated journal started the day you learn of the breach, a GP note, and a witness statement. A record of your data spreading to data broker sites shows ongoing, downstream harm. Contemporaneous evidence, written at the time, is what turns a base settlement into a properly argued claim.
Why are most people’s claims weaker than they should be?
You were in the breach. Your data was exposed. But when a solicitor or settlement administrator asks you to document your harm, most people produce nothing — and receive the base amount.
“I was worried about it” is not a compensable claim. “I experienced genuine anxiety that disrupted my sleep and work for three weeks, as documented in these dated journal entries, and visited my GP on [date] where the breach was discussed as a contributing cause” — that is.
Courts and settlement administrators are not unsympathetic. But they operate within legal frameworks that require harm to be real, specific, and evidenced. The evidence required is rarely complicated or expensive to produce. It just has to exist.
What is material harm? The financial evidence
Material harm is the easier category — you’re showing money lost or spent as a direct result of the breach.
- Bank and card statements showing unauthorised transactions. Highlight each one and note the date relative to the breach disclosure.
- Receipts for credit monitoring or identity theft protection purchased after the breach was announced. That subscription cost is a direct out-of-pocket loss caused by the breach.
- A time log. UK courts accept £15–£25 per hour for time spent resolving fraud. Write down every call, every form, every hour disputing charges — “2 hours on [date] on hold with fraud department; 1.5 hours completing police report.” Date each entry.
- Professional invoices — solicitor, accountant, or credit repair service engaged because of fraud from the breach.
- Salary slips or leave records if you took time off to deal with fraud. Lost income is compensable if documented.
Keep originals. Digital copies with timestamps work, but have the originals available.
What is non-material harm? Documenting distress
The CJEU’s ruling in C-300/21 (2023) confirmed that non-material damage under GDPR — distress, anxiety, loss of control over personal data — is compensable. The court also confirmed that mere exposure is not enough. The harm must be real and certain, not hypothetical.
Genuine distress is compensable — but you have to prove it’s genuine.
Start a contemporaneous journal. The day you learn of the breach, open a document and start writing. Date every entry. Describe how you felt — anxious about unknown consequences, unable to sleep, checking your account repeatedly through the night. Write in plain language. The contemporaneous nature (written at the time, not reconstructed later) is what makes entries credible.
Visit your GP if the distress is genuine. If the anxiety has affected your sleep, appetite, or concentration at work, see your doctor and mention the breach as a contributing factor. A GP record noting “patient experiencing anxiety following notification of personal data breach” is medical evidence that exists independent of your own account.
Keep records of conversations with family or colleagues. Maybe people around you observed you distressed: checking accounts repeatedly, expressing worry, losing sleep. A short written statement from them supports your claim. This matters most in higher-value individual GDPR claims.
Document the loss of control itself. C-300/21 specifically recognises loss of control over personal data as non-material harm. Say your data is now accessible to parties you never authorised, listed on sites you never consented to. Document that in your journal, alongside any evidence of where your data has appeared.
How does data broker exposure prove harm?
After a data breach, your personal information doesn’t stay in a single database. It gets absorbed into data broker ecosystems, such as people-search sites, marketing databases, and background check services, often within weeks.
A scan showing your name, address, and phone number listed across 40 or 50 data broker sites after a breach is documented evidence. It shows the breach caused your data to spread beyond its original context. That is downstream harm. It’s verifiable, dateable, and directly relevant to establishing the extent of exposure in a claim.
An example exposure report shows the kind of documentation a scan produces: exactly which sites list your personal information. When you can run and date-stamp your own, that evidence shows a court or settlement administrator that the breach didn’t just expose your data in theory. It caused your data to propagate to dozens of third-party sites you never consented to.
Under GDPR and the UK’s Data Protection Act 2018, your data appearing on these sites without consent is itself a data protection issue. As evidence in a compensation claim, it shows that the real-world consequence of the breach extended far beyond the breached company’s own systems.
Building your evidence file
Organise your evidence before you need it. By the time a settlement is announced, evidence gaps are hard to fill retroactively.
Keep these in a single folder:
- The breach notification email (screenshot it)
- HIBP confirmation showing your email in the breach
- Bank and card statements with fraudulent transactions highlighted
- Receipts for credit monitoring purchased post-breach
- Your time log — dates, durations, activities
- Your distress journal (dated from the day you learned of the breach)
- A data broker scan showing your exposure (screenshot with date)
- GP records if you sought medical attention
- Police reports or ICO/FTC complaints you filed
This takes an afternoon to assemble if you start now. It takes months to reconstruct if you wait.
When should you involve a solicitor?
For claims above approximately £3,000 in the UK, or where your documented losses are significant, a data breach solicitor adds real value. Most operate on a no-win-no-fee basis — you pay nothing unless your claim succeeds.
Bring your evidence file to the first consultation. A solicitor who sees financial statements, a time log, a distress journal, and a data broker scan can assess your claim quickly. One presented with nothing but your recollection of anxiety has far less to work with.
For more on finding and engaging a data breach solicitor, read our guide at /blog/data-breach-solicitor-no-win-no-fee/.
Frequently asked questions
How do I prove harm in a data breach claim? Document material harm (fraudulent charges, monitoring receipts, a time log) and non-material harm (a dated distress journal, a GP note, a witness statement). A record of your data spreading to broker sites shows downstream harm.
Can I claim for anxiety alone? In the UK and EU, yes, under the C-300/21 ruling. But the distress must be real and documented, not hypothetical. A contemporaneous journal and a GP record are the strongest evidence.
What evidence gives the biggest payout boost? Contemporaneous documentation. Evidence written at the time you learned of the breach carries far more weight than a timeline reconstructed months later for the claim.
When should I gather evidence? The day you find out. Assembling a strong evidence file takes an afternoon if you start now, and months to reconstruct if you wait until a settlement is announced. See our guide on how to document a data breach claim.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.