Last Updated 14th October 2025. UK GDPR breach examples can include incidents caused by human error, such as emailing the wrong person and losing devices, as well as intentional acts. These acts can occur because of cyberattacks, malware scams, and the theft of personal records. Breaches can involve personal data being lost, altered, destroyed, or otherwise disclosed without authorisation.
This guide provides examples of the data breach compensation you could receive if your personal information has been compromised following a breach of data protection. We will also discuss the eligibility requirements you must meet in order to claim and useful evidence you can obtain to support your case.
There are certain pieces of legislation that outline the responsibilities certain entities have to protect your personal data. We will discuss this further in our guide as well as looking at how your data could be breached if these laws are not adhered to.
Keep reading to learn more about how to claim compensation for a data breach. You can also direct your questions to an adviser. They can offer free advice regarding your potential claim. To reach them, you can:
We Can Help With Your Claim
Our team of specialist advisors are ready to assist you with your data breach claim
Choose A Section
- What Are Potential Examples of Data Breach Compensation?
- Fine Examples From The ICO
- Can I Make A Data Protection Breach Claim?
- Do I Need To Report A Data Breach To The ICO?
- Why Use Our Panel Of No Win No Fee Data Breach Solicitors?
- Learn More About Claiming For A Breach Of Data Protection
What Are Potential Examples of Data Breach Compensation?
You may be seeking examples of data breach compensation if you are eligible to bring forward this type of case. A settlement for this type of claim may include compensation for:
- Material damage – the monetary losses you experienced because of a data breach. For example, if you need to relocate due to the breach of your personal data, you could recover your moving costs. You should gather evidence of these losses, such as bank statements and invoices.
- Non-material damage – the psychological harm you’ve experienced following a breach of your personal data, such as PTSD, anxiety, depression, or distress.
You could be eligible to receive compensation for either one of these things or both.
Legal professionals, when valuing non-material damage, may refer to the Judicial College Guidelines (JCG) to help them. The JCG contains compensation guidelines for different types of harm.
Guideline Table
In the table below, all but the top row use the JCG as a source. However, please only use this table as a guide. The data breach compensation amount you could specifically receive cannot be guaranteed, as no two claims are ever the same.
| Harm | Notes | Guideline Compensation Amount |
|---|---|---|
| Multiple Instances of Psychological Harm with Financial Loss | Finance losses may include the cost of therapy. | Up to £250,000+ |
| Psychiatric Condition (General) | Severe - Prognosis is poor due to problems coping with life in general, relationships, work, and education. | £66,920 to £141,240 |
| Moderately Severe - Prognosis is much more optimistic in relation to the problems mentioned above. | £23,270 to £66,920 | |
| Moderate - Prognosis is good in relation to the problems mentioned above. | £7,150 to £23,270 | |
| Less Severe - Considers length of time a disability is experienced. | £1,880 to £7,150 | |
| Post-Traumatic Stress Disorder | Severe - All aspects of life badly affected by permanent effects. | £73,050 to £122,850 |
| Moderately Severe - Better overall prognosis when professional help is sought for recovery. | £28,250 to £73,050 | |
| Moderate - Large degree of recovery, perhaps with ongoing effects that aren't overly disabling. | £9,980 to £28,250 | |
| Less Severe - Full or nearly full recovery within 1-2 years, with only minor symptoms ongoing. | £4,820 to £9,980 |
Please contact us to learn more about how data breach compensation is calculated. Additionally, continue reading for some data protection breach examples.
Fine Examples From The ICO
Some of the most prominent fine examples from the ICO include a £20 million penalty imposed on British Airways in 2020 and a £4.4 million levy enforced against Interserve in 2022. The Information Commissioner’s Office (ICO) is the UK’s independent body responsible for enforcing data protection laws. As part of its duties, the ICO has the power to fine organisations for breaching this legislation, including:
- British Airways: Fined £20 million after a breach affected over 400,000 customers. Hackers compromised the company’s systems in 2018, gaining access to login information and addresses, amongst other personal data. The ICO found the airline company had weak security measures in place and had failed to adhere to data protection legislation.
- Interserve: A £4.4 million fine was imposed following a phishing attack that impacted up to 113,000 of the construction group’s current and former employees. This breach also compromised 283 systems and led to hackers accessing bank details, national insurance numbers, and other personal information. An ICO investigation noted a lack of adequate risk assessments and training, together with outdated cybersecurity measures.
- Uber: The transportation company paid a £385,000 fine in 2018 after ‘avoidable data security flaws’ allowed a hacker group to access the personal details of about 2.7 million UK customers. Although the information included full names, addresses, and contact information, the ICO found that Uber did not take steps to notify people about the breach.
Next in our guide to examples of data breach compensation, we will take a look at some ICO fines issued in 2025.
Source: https://www.bbc.co.uk/news/technology-54748843
Source: https://www.theguardian.com/business/2022/oct/24/outsourcer-interserve-fined-4-point-4m-cyber-attack-failings-data-breach-personal-information
Source: https://www.bbc.co.uk/news/technology-46357001
2025 UK Data Breach Fine Examples
Further 2025 UK data breach fine examples include £3.07 million for Advanced Computer Software Group Ltd and £2.3 million for 23andMe, Inc. Let’s take a look at these fines in more detail, together with a penalty imposed on Birthlink:
- Advanced Computer Software Group Ltd: A ransomware attack in 2022 gave hackers access to the IT company’s health and care subsidiary. This risked the personal data of 79,404 people, disrupted NHS 111 services, and prevented access to patient records. The ICO concluded that there had been a failure to fully implement security measures, including multi-factor authentication (MFA), and issued a £3.07 million fine on 26 March.
- 23andMe, Inc.: The genealogy company was fined £2.3 million after hackers used login credentials stolen in previous unconnected data breaches. This gave unauthorised access to personal data belonging to 155,592 UK residents, including their health reports, addresses, race, religion, and ethnicity. The ICO’s findings highlighted various security system inadequacies for authenticating and verifying customers during the login process.
- Birthlink: This Scottish charity was fined £18,000 on 28 July 2025 for the destruction of around 4,800 records (upwards of 10 per cent of which may have been irreplaceable). This information included photographs and handwritten letters. The ICO found that the organisation lacked policies and procedures that could have prevented the destruction of the records.
Source: https://www.bbc.co.uk/news/articles/cp3yv1zxn94o
Source: https://www.bbc.co.uk/news/articles/c4grggw4n56o
For a personalised discussion of data breach compensation amounts, feel free to get in touch today. Please also continue reading, as our guide to data breach compensation examples will outline the eligibility criteria for making a claim.
Can I Make A Data Protection Breach Claim?
The Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR) set down obligations of organisations when processing personal information.
Under data protection law, entities known as data controllers and processors must uphold certain standards while processing individuals’ personal data. To explain:
- A data controller makes decisions regarding how and why to process personal data. They can also process the data themselves.
- A data processor acts on behalf and under the instruction of a data controller in order to process the data
If they fail to adhere to data protection law, this could result in a personal data breach. A breach of personal data is defined as a security incident that impacts the confidentiality, availability, or integrity of personal information.
Personal data is defined as information that might be used to identify living individuals, either by itself or when processed in combination with other data. This could include your IP address, birth date, or salary.
You may be able to claim compensation if you can prove the failings of a data processor or controller led to data breach which compromised your personal data. You must also have experienced psychological harm or financial loss as a result.
To discuss examples of data breach compensation payouts that could be awarded after a successful claim, get in touch.
We Can Help With Your Claim
Our team of specialist advisors are ready to assist you with your data breach claim
Examples of Data Protection Breaches
There are several ways a breach of data protection could occur, such as:
- An airline could fail to update its security systems in a timely manner, resulting in an airline data breach that reveals customers’ passport data.
- Your GP could forward an appointment confirmation letter to the wrong address leading to a medical records data breach in which information about a medical condition is revealed.
- A website data breach could compromise your personal information if adequate security is not installed on the site.
- An email data breach could occur after a company sent your personal information to the wrong email address.
Speak to our advisers to discuss various types of personal data breach claims.
Do I Need To Report A Data Breach To The ICO?
After discussing some examples of data breach compensation, we’ll focus on whether you have to report a data breach. The data subject may discover the personal data breach after some time. Therefore, organisations are legally mandated to report data breach incidents within 72 hours if there is a high risk of compromise of the rights and freedoms of the data subject.
Here are some of the steps you could take after finding out about the data breach:
- The organisations handling your personal data are supposed to inform you once they discover that your data has been breached. However, if you find out about the breach by yourself, you must submit a written complaint to the organisation.
- If you aren’t satisfied with the organisation’s response, you could submit a complaint to the ICO. However, you must take this step within 3 months of your last interaction with the organisation. If you make a complaint outside of this timeframe, the ICO may refuse to act on your complaint.
- You must bear in mind that the ICO cannot award you compensation, but it can investigate your complaint. Their findings will definitely help to ascertain how the data breach occurred and could be useful as evidence.
- It’s important to start collecting evidence to highlight the material or psychological impact of the data breach on you.
- Contact a data breach solicitor to help you with the entire procedure and to answer all your questions.
You can get in touch with us, and if you have an eligible claim, we’ll connect you with the specialist data breach lawyers on our panel.
Why Use Our Panel Of No Win No Fee Data Breach Solicitors?
Though they aren’t required to make a claim, data breach solicitors can provide useful services during the process. For instance, they can help:
- Collect evidence
- Build your case
- Ensure the claim is filed within the relevant time limit
- Use examples of data breach compensation payouts to help them value your claim.
What’s more, the No Win No Fee solicitors on our panel could offer these services under a Conditional Fee Agreement (CFA). This type of No Win No Fee arrangement means you don’t pay ongoing or upfront solicitor service fees. Additionally, you won’t pay these fees if your claim fails.
Instead, your solicitor will take a success fee from the compensation. This is deducted as a percentage and is subject to a legislative cap, so you benefit the most from a successful outcome.
Contact Us
Speak to our team to discuss examples of data breach compensation payouts that could be awarded following a successful claim. Our advisers can offer a free consultation about your potential data breach claim, discussing any information you’d like to ask about. To get in touch, you can:
- Fill in our ‘Contact Us’ form
- Phone 020 8050 6279
- Talk to our team via the onscreen chat
Learn More Claiming For A Breach Of Data Protection
Below, you can find more of our guides:
- Find out how to report a UK GDPR data breach.
- Learn about claiming university data breach compensation.
- Read about pharmacy data breach claims.
- Learn about SGN data breach compensation claims
Related information from third parties:
- Data Breaches – Guidance from the National Cyber Security Centre (NCSC) about data breaches
- Make A Complaint – Government resource about complaints regarding potential data breaches
Thank you for reading this guide on examples of data breach compensation.