A breach does not automatically produce compensation. A claim normally requires an infringement, material or non-material damage, and a causal link. Court action also creates procedure, limitation and costs risks.
Key points
- The ICO cannot award compensation.
- A court can enforce rights and may award compensation for damage, including distress, caused by an infringement.
- An ICO view can be evidence but does not bind the court.
- Pre-action conduct, limitation, jurisdiction and costs should be checked before proceedings.
- Preserve contemporaneous evidence of loss, distress, mitigation and the organisation’s response.
Enforcement and compensation are different
You may want an order requiring compliance, damages, or both. A request for a missing SAR response is different from proving financial loss or distress caused by the failure. Define the remedy before valuing the claim.
Causation and evidence
Keep bank losses, fraud reports, medical or support records where appropriate, time-stamped impact notes and steps taken to reduce harm. Avoid inflated figures unsupported by evidence. The court decides whether damage was caused and the appropriate amount.
Before proceedings
Set out the proposed legal basis, facts, damage, documents and remedy in a proportionate pre-action letter. Consider settlement or alternative dispute resolution. Court rules differ across England and Wales, Scotland and Northern Ireland, and limitation can be complex, so obtain independent advice.
ICO and court routes
You do not necessarily have to wait for the ICO, but a focused regulatory outcome may help clarify compliance. The ICO cannot give compensation advice. Do not let a regulatory complaint obscure a limitation deadline for any intended claim.
Build the record
Turn the concern into answerable questions
- Identify the exact personal data or processing activity.
- Record dates, systems, people and any decision or disclosure affected.
- Choose the right legal tool for the outcome you need.
- Ask for a reasoned answer and a specific corrective action.
- Keep the request, acknowledgement, evidence and final response together.
If several rights are involved, number them separately. A request for access, a request to correct data and a complaint about previous handling can run alongside one another, but they have different legal tests and may have different deadlines.
Worked examples
| What happened | The data-protection question | Likely next route |
|---|---|---|
| Breach causes documented fraudulent loss | Quantify direct loss, mitigation and causation and seek legal advice. | Complaint, insurer and court advice |
| Late SAR causes frustration only | Assess whether there is provable damage; seek compliance first. | Section 164A complaint and ICO |
| ICO finds likely non-compliance | Use it as evidence, not as a binding judgment or automatic valuation. | Pre-action assessment |
Useful wording
“I allege that [infringement] caused [specific material loss/distress]. The enclosed chronology and evidence show the causal link and mitigation. I seek [compliance, correction, settlement amount or other remedy]. Please preserve relevant records and provide your reasoned response.”
Keep the request focused on the data or processing activity. Ask the organisation to identify its position and the corrective action it will take. Keep a copy and proof of delivery.
Official sources
Check the rules behind this guide
- Taking your case to court and claiming compensation - ICO
- Data Protection Act 2018 sections 167 and 168
These are official or primary sources. Check the current text before relying on a formal deadline, procedure or court route.