A data breach does not automatically create a payout. But UK data-protection law recognises non-material damage such as distress, and a claimant can seek compensation where the legal requirements are met.
Distress Can Be Compensable Under UK Data-Protection Law
Article 82 UK GDPR provides a right to compensation for material or non-material damage caused by an infringement. Section 168 of the Data Protection Act 2018 expressly states that, for Article 82, "non-material damage" includes distress.
The ICO confirms that compensation can cover distress and other non-material damage. But there must be damage caused by the infringement: a breach of the law by itself does not automatically establish a compensable claim.
What Lloyd v Google Actually Decided
The Supreme Court's 2021 decision in Lloyd v Google [2021] UKSC 50 concerned the old Data Protection Act 1998 and a proposed representative/class-style claim. The Court held that the proposed representative action could not recover damages simply by proving that everyone fell within the alleged class; individual circumstances and entitlement had to be established.
It is therefore inaccurate to cite Lloyd as saying "no one can recover for distress without financial loss" under the current UK GDPR. The current regime is different, and the DPA 2018 expressly recognises distress as non-material damage.
You Still Need Evidence of Impact
The ICO warns that if a claimant cannot demonstrate damage or distress, a court may not award compensation and costs risks can arise. Build a contemporaneous record of what happened and its effect on you.
- What data was exposed.
- How the breach or disclosure happened.
- When you learned about it.
- Actual incidents of anxiety, loss of sleep or other distress.
- Any financial or practical consequences.
- Steps taken to mitigate harm.
Financial or Medical Data Can Make the Evidence More Concrete
A breach involving health, financial or identity information can create serious risks, but the category of data alone does not establish a fixed compensation amount. The court looks at the circumstances and impact of the individual claim.
How to Approach the Company
- Ask the organisation for details of the incident and the data affected.
- Preserve the breach notice and all correspondence.
- Set out the harm you say the breach caused.
- Ask whether the organisation will settle compensation.
- If no agreement is reached, consider independent legal advice before court proceedings.
The ICO can investigate data-protection compliance but cannot award compensation. A compensation claim is ultimately for the organisation and, if necessary, the court to resolve.
What This Means Practically
- Distress is recognised as non-material damage under the current regime.
- Lloyd v Google should not be presented as a ban on distress-only compensation under UK GDPR.
- A breach alone does not guarantee compensation.
- Individual evidence of damage or distress matters.
- Get legal advice before litigating a complicated claim.
Sources
- ICO — Taking your case to court and claiming compensation. ico.org.uk
- Data Protection Act 2018 — Section 168 compensation for contravention of the GDPR. legislation.gov.uk
- UK Supreme Court — Lloyd v Google [2021] UKSC 50. supremecourt.uk