Protecting yourself and claiming compensation after a data breach.
Last updated on 25 June 2026
This guide explains your rights and how to claim data breach compensation in the UK.
If you already know which breach affected you, you can check if you’re eligible to join a claim now.
In this guide…
What you need to know about your data breach rights
What you need to know straight away
Companies must tell you within 72 hours if a data breach could put you at risk. If they fail to protect your data and you suffer harm – whether financial loss or distress – you may be entitled to compensation.
Companies must report serious breaches to the Information Commissioner’s Office (ICO) within 72 hours. If the breach puts you at high risk, they must also tell you without undue delay, explain what data was affected, what it means for you, and what they are doing to fix it. If they fail to do this, it can strengthen any compensation claim you make.
What is a data breach?
A data breach happens when an organisation fails to keep your personal information secure. This could be due to a cyber attack, human error or a system failure, and may result in your data being accessed, lost or shared without your permission.
This can include contact details, financial information, identity documents, login credentials and sensitive data such as health records.
The data breaches that make headlines are often the result of cyber attacks, where criminals gain unauthorised access to personal or financial information held by organisations you trusted.
Under UK GDPR, the responsibility to protect your data sits with the organisation that holds it. If a breach happens, it is not something you did wrong.
How a data breach could affect you
A data breach can feel unsettling and intrusive. Your personal information has been exposed without your consent, and understanding the risks can help you act quickly.
In the short term, you may face phishing scams, where fraudsters use your details to send convincing emails or texts, often pretending to be the organisation involved. There is also a risk of identity theft, account takeovers or unauthorised transactions.
Over time, the impact can continue. Your data may be shared or sold between criminals, leading to repeated scam attempts. In some cases, sensitive information may become public, causing reputational damage. Many people also experience ongoing stress or anxiety after a breach.
You should be especially cautious of messages or calls claiming to be from the organisation involved. These can look genuine but are designed to steal your information or gain access to your accounts. If you are unsure, contact the organisation directly using details from their official website.
How to protect yourself after a data breach
If you’re told your data may have been breached, taking a few simple steps can help limit the damage.
- Start by contacting the organisation directly, using their official contact details, to confirm exactly what information was affected and what they are doing about it.
- It’s important to secure your accounts as soon as possible. Change your passwords, especially if you’ve reused them elsewhere, and enable two-factor authentication where available. Even if only basic details were exposed, there is still a risk.
- Keep a close eye on your bank and credit card statements for any unusual activity. Setting up alerts through your bank can help you spot problems early. You can also check whether your details have appeared in known breaches using a free service like haveibeenpwned.com.
- Be alert to phishing scams, which often increase after a breach. Be cautious of unexpected messages, especially those asking for personal information or urging you to act quickly. Legitimate organisations will not ask for sensitive details by email or text.
- Consider extra protection if you are concerned. You can check your credit report with agencies such as Experian, Equifax or TransUnion, and you may want to explore protective registration with Cifas, which adds a warning flag to your details. If money has been stolen, contact your bank immediately – rules introduced in October 2024 give stronger protections against unauthorised payments.
Once you’ve secured your accounts, it’s worth checking whether you could claim compensation for what’s happened. For major breaches, you may be able to join a group claim with no upfront cost.
Claiming compensation: your legal rights
You may be able to claim compensation if a company fails to protect your data and you suffer harm. This includes both financial losses and emotional distress.
You do not need to have lost money to make a claim. Distress and anxiety are recognised under UK law, although financial losses may increase the amount of compensation.
Compensation can cover financial losses such as money stolen through fraud, the cost of replacing documents, or time spent dealing with the consequences of the breach. It can also include emotional distress, loss of control over your data, reputational damage, and the time and inconvenience involved in putting things right.
How to claim
There are three main ways to take this forward.
- You can start by complaining directly to the organisation. Some companies will offer compensation at this stage, so it is worth giving them the opportunity to resolve the issue. Keep a record of any correspondence.
- If you are not satisfied with their response, you can escalate the matter to the Information Commissioner’s Office. The ICO can investigate and fine organisations, but it does not award compensation to individuals.
- For larger breaches affecting many people, joining a group claim is often the most effective option. This allows individuals to pursue compensation together, usually on a no win, no fee basis with no upfront cost.
You can check if there’s an active claim for your breach below.
Is there a group claim for your data breach?
For some of the largest data breaches, group claims have already been launched. These allow thousands of affected people to pursue compensation together.
Check below to see if your data breach is listed and whether you can join a claim.
If you can’t find your breach, you can register your interest and we’ll let you know if a relevant claim becomes available.
Can’t find your data breach?
If your breach isn’t listed, you can register your details below. We track new data breaches and will let you know if a claim becomes available, or point you to the right next steps in the meantime.
What to do if your child’s data was breached?
Children’s personal data is given extra protection under UK data protection law. If your child’s information is exposed, you can claim compensation on their behalf as a parent or guardian.
Claims involving children’s data are often treated more seriously because the risks can last longer. In some cases, identity theft may not be discovered until years later.
If your child’s data has been breached, you can make a claim on their behalf and consider protective registration with Cifas. Organisations such as schools and nurseries are expected to meet particularly high standards when handling children’s data.
You can also check whether there is an active claim for your child’s data breach using the links above.
Common questions about data breaches
Companies must notify you if a breach puts you at high risk. You can also check whether your details have appeared in known breaches using services like haveibeenpwned.com.
Check the message is genuine by contacting the organisation directly. Then change your passwords and enable two-factor authentication where possible.
Yes. You can claim for distress or inconvenience even if there has been no financial loss.
A group claim brings together large numbers of people affected by the same breach to pursue compensation collectively, often as a no win, no fee claim.
You can check the current claims list above or register your interest if your breach isn’t listed.
You usually have six years in England, Wales and Northern Ireland, and five years in Scotland. Acting sooner is always better.
Not for smaller claims. For larger claims or group actions, many lawyers work on a no win, no fee basis.
No. The ICO can investigate and fine organisations, but compensation must be claimed separately.
You can claim on their behalf. See the section above for more detail.
A data breach is when your data is exposed. Identity theft is when someone uses that data to impersonate you.
Possibly. If the breach made the scam more convincing, this may support your claim. It will depend on the circumstances.
No, you you can use any free service offered first. Free tools are usually enough for most people unless your risk is particularly high.
Register for updates
Don’t miss important updates about data breaches, compensation claims, and your consumer rights.
About Consumer Voice
Consumer Voice helps people get back money they may be owed when companies get it wrong. We explain your rights clearly, so you can understand whether you may be owed compensation, whether you can join a claim, and what steps to take next.
Data breach claims you can join
-
Legal Aid Agency data breach
If you applied for legal aid between 2007 and 2025, you could be eligible for a group claim. Register your interest to find out.
-
Capita data breach
Capita was fined £14m after a 2023 cyber attack exposed millions of people’s data. Register for updates on the ongoing legal action.
-
Facebook data misuse
Facebook faces a £2.1bn legal claim that alleges it exploited 46m UK users by unfairly profiting from their data. Sign up to stay updated.
Take a look at our Group claims page to see all of our current claims.
Data breaches we’re tracking
-
Manchester Airports Group data breach
On the weekend of 23 August 2026, criminal hackers gained the personal data of approximately 8.7m customers across 3 major UK airports.
-
South Staffordshire Water data breach compensation
In 2022, hackers accessed South Staffordshire Water’s systems after an undetected breach, publishing the personal and financial data of 633,887 UK customers and employees.
-
English National Ballet data breach
In August 2026, English National Ballet revealed that customer contact information had been leaked following a supply chain attack.
-
Southern Water data breach
On 22 January 2024, Southern Water discovered a cybercriminal claim that data had been stolen from its IT systems. On 12 February 2024, it confirmed that data from a limited part of its servers had been compromised following an illegal intrusion.
-
23andMe data breach
Between April and September 2023, a hacker accessed 23andMe using login credentials stolen from previous unrelated data breaches, exposing the personal information of 155,592 UK residents.
-
NHS Synnovis data breach
In June 2024, criminal hackers stole patient data from Synnovis, a pathology provider serving several NHS hospitals & GP surgeries across south east London.
-
ManoMano data breach
In January 2026, a hacker stole personal data from ManoMano, claiming approximately 37.8 million accounts across Europe were affected.
-
Co-op Member data breach
In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.
-
CarGurus data breach
In February 2026, CarGurus, the online marketplace used by millions of people to research and buy cars, had its customer data stolen.
-
Booking.com data breach
In April 2026, Booking.com confirmed that unauthorised third parties had accessed guests’ personal booking information.
-
Lloyds Banking Group breach
Lloyds, Halifax and Bank of Scotland customers may have had sensitive financial data exposed in the March 2026 breach. Learn your rights.
-
M&S data breach
M&S data breach. In April 2025, Marks & Spencer experienced a cyber attack that caused widespread disruption across its digital operations.
