British Airways passengers who had their payment card data exposed in the 2018 breach received between £2,000 and £6,000 each. NHS patients whose sensitive medical records were leaked in trust-level breaches have received £750 to £3,000. These aren’t settlements from American class actions — they’re UK compensation claims, many filed by ordinary people with no legal background, against some of the largest organisations in the country.
If your personal data was compromised in a breach, you have a legal right to pursue compensation. Here’s how the system actually works.
This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation.
The short answer: Under UK GDPR Article 82, you can claim compensation if a data breach caused you material harm (financial loss) or non-material harm (distress). Typical UK awards run £750–£6,000. Start free by filing an ICO complaint, then use the Small Claims Court for claims up to £10,000 (no solicitor needed) or join a group action for larger breaches. For bigger claims, no-win-no-fee solicitors take 25–35% only if you win. After Lloyd v Google, you must show real impact, not just presence in a breach.
More people have won UK data breach claims than you realise
The numbers above aren’t outliers. HMRC contractor breach victims have received £750 to £2,500 each. In NHS Digital and GP surgery breaches involving sensitive mental health or sexual health records, courts have awarded at the higher end precisely because the data was more sensitive.
What these cases share: the claimants documented their experience. They kept records of what happened, when they found out, and what impact the breach had on them. That documentation — not just the fact that the breach occurred — is what drove the awards.
The UK has one of the most active data breach compensation ecosystems in the world. No-win-no-fee solicitors, group litigation orders, and a Small Claims Court that genuinely works for individual claims under £10,000 all contribute to making this viable.
Your legal right: UK GDPR Article 82
UK GDPR Article 82 gives every individual the right to receive compensation if a breach of the regulation caused you damage. You can claim against the data controller (the organisation that held your data) or the data processor (a company processing it on their behalf).
The damage can be material — financial loss, like fraudulent charges, identity theft costs, or money spent fixing problems caused by the breach. Or it can be non-material — distress, anxiety, loss of sleep, and loss of control over your personal information. Both categories are compensable.
One important precedent to understand: Lloyd v Google [2021] UKSC 50. The Supreme Court dismissed a representative action (a form of group claim). Its basis was that “mere loss of control” over data, without evidence of actual individual harm, was not sufficient to sustain the claim at scale. This doesn’t affect individual claims. It means you need to show some real impact: genuine distress, financial consequences, or specific harm from the breach. Presence in a breach database alone is not enough.
Should you file an ICO complaint first?
Before pursuing a civil claim, file a complaint with the Information Commissioner’s Office. This is free and doesn’t require a solicitor. It does two things: it creates an official record, and if the ICO finds the company violated UK GDPR, those findings support your subsequent civil claim.
File at ico.org.uk/make-a-complaint. The process takes around 10 minutes. You’ll describe the breach, when you found out, and what harm you’ve experienced.
The ICO typically provides an initial assessment within three months. It doesn’t award compensation directly (that happens through civil courts), but its findings carry real weight. The £20 million fine against British Airways and £18.4 million against Marriott both came from ICO investigations. Claimants in the group actions used those regulatory findings as evidence of the companies’ failings.
Don’t wait for the ICO investigation to conclude before starting a civil claim. The two processes run in parallel.
Can you use Small Claims Court without a solicitor?
Does your loss or distress put your claim in the £1,000 to £10,000 range? Then the Small Claims Court (England & Wales) is a realistic option, and you don’t need a solicitor to use it.
First, send a Letter Before Action (LBA). This is mandatory before filing. The LBA must: identify yourself, describe the breach and the company’s failings, state what damage you’ve suffered, specify the compensation you’re seeking, and give the company 14–28 days to respond before you file. Send it by email and recorded post. Keep copies.
If they don’t respond or refuse without adequate grounds, file at gov.uk/make-court-claim-for-money (Money Claim Online). Filing fees range from £35 to £455 depending on claim size. You’ll submit your particulars of claim — a short document describing the breach, the legal basis (UK GDPR Article 82), and your losses. Witness statements, medical records, and documentation of your distress all strengthen the case.
The Small Claims track is designed for ordinary people. Judges understand data breach claims. This route makes sense when your losses are documented but modest, when no group action is available, and when you’re comfortable handling paperwork without a solicitor.
How do group actions work for larger claims?
For significant breaches — particularly those affecting tens of thousands of people — group litigation orders (GLOs) let claimants pursue claims together. This increases leverage against defendants and reduces individual cost.
To find active group actions: search “[company name] data breach group action UK” and check the websites of specialist firms. As of mid-2026, active cases include British Airways (Hayes Connor, JMW Solicitors), Marriott, several NHS Trust breaches, and TikTok’s processing of children’s data.
Registering interest with a participating firm is free. You complete an online form, provide basic details about your involvement in the breach, and the firm contacts you about next steps. You don’t commit to anything at registration. If the case settles, claimants are typically placed into compensation bands based on evidence of harm — which is why documentation matters even in a group action.
How do no-win-no-fee solicitors work?
A conditional fee agreement (CFA) — commonly called no-win-no-fee — means you pay the solicitor nothing upfront and nothing if you lose the case. If you win, the solicitor takes between 25% and 35% of your compensation award as their success fee.
The phrase “no win, no fee” can obscure some nuances. In some CFA structures, if you lose, you may still be liable for the other side’s legal costs — or for certain out-of-pocket expenses (called disbursements) your solicitor incurred. Ask explicitly when you sign: what are my out-of-pocket costs if we lose? Most consumer data breach CFAs are structured so the claimant pays nothing in a loss scenario, but confirm this before signing.
Solicitors specialising in UK data breach claims include Hayes Connor, JMW Solicitors, Keller Postman UK, and Slater and Gordon. Most offer free initial consultations. If you’ve received a breach notification letter, search the company name and “data breach claim.” A specialist firm is often already running a group action. For help choosing one, see our no-win-no-fee solicitor guide.
Frequently asked questions
Can I claim data breach compensation in the UK? Yes, under UK GDPR Article 82, if a breach caused you material harm (financial loss) or non-material harm (distress). You don’t need financial loss to claim, but after Lloyd v Google you must show real impact, not just being in a breach.
How much is a UK data breach claim worth? Typical awards run £750–£3,000 for distress, rising to £2,000–£6,000 for sensitive data or documented financial harm. British Airways claimants settled around £2,000–£6,000 each.
Do I need a solicitor? Not for a Small Claims Court claim up to £10,000, which is designed for litigants in person. For larger claims or group actions, a no-win-no-fee solicitor takes 25–35% only if you win.
How do I start a UK data breach claim? File a free ICO complaint first, then send a Letter Before Action to the company. If unresolved, file in Small Claims Court or join a group action. A record of your data spreading to people-search sites helps prove ongoing harm.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.