Personal Data Breach Compensation — 2026 Article 82 Guide

A data breach triggers a 72-hour regulatory clock and, for individuals affected, can be a financial compensation opportunity. The regime is precise and Chris drafts on both sides — controllers notifying properly, and individuals claiming under Article 82.

Controller’s obligations

ICO notification (Article 33)

• Within 72 hours of awareness
• Unless unlikely to result in risk to individuals
• Must include nature, categories, approximate numbers, DPO contact, consequences, measures
• Phased notification permitted where information incomplete

Individual notification (Article 34)

• Without undue delay where high risk
• Clear and plain language
• Must include nature, DPO contact, consequences, measures
• Exemptions — where data encrypted and inaccessible, or where measures taken eliminate high risk, or where direct notification would involve disproportionate effort (public communication instead)

Individual claims under Article 82

Affected individuals can claim:

• Material damage — actual financial loss (fraud, identity theft, protective costs)
• Non-material damage — distress, anxiety, loss of control over data

Awards in reported cases have ranged from hundreds of pounds for minor breaches to thousands for significant distress. Group claims (class actions) have aggregated into substantial sums.

Structure — individual claim

1. The breach

When, how, what data, how you were notified, your reference with the controller.

2. The impact

Distress (describe). Protective costs (credit monitoring, password changes). Secondary fraud attempts if any. Medical impact if severe.

3. The claim

“Compensation under Article 82 UK GDPR. Material damages of £[X] for [specific costs]. Non-material damages of £[X] for distress and anxiety under Lloyd v Google / Vidal-Hall v Google framework.”

4. Timeline

“Resolution within 28 days, failing which County Court claim and/or class action participation will follow.”

The Lloyd v Google limitation — and the workaround

Supreme Court in Lloyd v Google restricted representative actions under CPR 19.8 for uniform data protection damages. But individual claims and opt-in group claims remain viable. Chris drafts individual-strength claims.

When criminal offences overlap

Deliberate unauthorised access or disclosure may constitute offences under s.170 DPA 2018. Complaints to ICO for criminal referral are distinct from compensation claims.

Can Chris draft the breach claim or notification?

Yes. For individuals: upload the breach notification, any losses, evidence of distress (counselling, GP notes, sleep diaries). Chris drafts Article 82 claim. For controllers: upload the incident facts, Chris drafts Article 33 notification to ICO and Article 34 communication to affected individuals.

Prepare to win. Plan not to fail.

Data breaches are routine. Compensation is specific. Chris drafts specific.

Frequently asked questions

What is a personal data breach notification and who must make one?

Under Article 33 UK GDPR a controller must notify the ICO of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. The notification must set out the nature of the breach, the categories and approximate numbers affected, the DPO contact, the likely consequences and the measures taken. Phased notification is permitted where the information is incomplete.

When must affected individuals be told about a breach?

Article 34 requires the controller to notify affected individuals without undue delay where the breach is likely to result in a high risk to them, in clear and plain language. Exemptions apply where the data was encrypted and inaccessible, where measures taken eliminate the high risk, or where direct notification would involve disproportionate effort (in which case a public communication may be used instead).

Can I claim compensation if my data was breached?

Affected individuals can claim under Article 82 UK GDPR for material damage — actual financial loss such as fraud, identity theft or protective costs — and for non-material damage such as distress, anxiety and loss of control over their data. The page notes that awards in reported cases have ranged from hundreds of pounds for minor breaches to thousands for significant distress.

What does a strong individual claim need to cover?

Chris structures the claim around four elements: the breach (when, how, what data, how you were notified, your reference with the controller); the impact (distress, protective costs such as credit monitoring, any secondary fraud, medical impact if severe); the claim itself for material and non-material damages; and a timeline for resolution, failing which a County Court claim and/or class action participation may follow.

How does Lloyd v Google affect a data breach claim?

The Supreme Court in Lloyd v Google restricted representative actions under CPR 19.8 for uniform data protection damages. Individual claims and opt-in group claims remain viable, and Chris drafts individual-strength claims accordingly.

Can Chris draft both the notification and the claim?

Yes. For individuals, upload the breach notification, your losses and evidence of distress (such as counselling notes, GP notes or sleep diaries) and Chris drafts the Article 82 claim. For controllers, upload the incident facts and Chris drafts the Article 33 notification to the ICO and the Article 34 communication to affected individuals. Related guides: Subject Access Request (SAR) guide · ICO complaint guide · N1 claim form guide · All civil court forms