Claiming compensation


The Information Commissioner cannot award compensation.

As an individual you may go to court to claim compensation for damage or distress caused by any organisation if they have breached the Data Protection Act.

When can I claim compensation under the Data Protection Act?

You have a right to claim compensation from an organisation if you have suffered damage because they have breached part of the Act.

You can normally only claim for any distress you have suffered if you have also suffered damage. However, if the organisation broke the law when they used your information for journalism, artistic or literary purposes, you can claim for distress alone.

How do I make a claim for compensation?

You do not have to make a court claim if an organisation agrees to pay you compensation. If you cannot reach an agreement with them, you can apply to a court for compensation alone or you can combine your claim with an action to put right any breach of the Act.

By law, the Information Commissioner cannot award compensation, even when she has said that in her view the organisation did breach the Act. If you cannot agree on compensation you have to make a claim in court.

For guidance on what you need to do to take a case to court, Citizen’s Advice provide information on how to do this in England, Scotland, Wales and Northern Ireland.

What do I need to do before I make a claim to the court?

The court will want to know what steps you have taken to try to settle the claim. This means you must write or speak to the organisation to see if you can reach an agreement.

If you fail to reach an agreement, you should write to the organisation before you start court proceedings, to tell them that you intend to take the matter to court. If you do not, the court may penalise you. You should send the letter by recorded delivery and address it to the person you have been dealing with, or the company secretary. In some cases, this may help prompt the data controller to settle the dispute.

Will it help me in court to involve the Information Commissioner’s Office?

You can ask the ICO to assess if the organisation breached the Act and we will tell you whether, in our view, it was likely or unlikely that the organisation broke the law. You can give a copy of the ICO’s letter to the court together with the evidence you have to prove your claim. However, a court will take their own view of the law and the judge may not agree with the ICO’s view.

You may want to ask our helpline first to see whether you potentially have a valid data protection concern that you can bring to us. Whether you complain to the ICO or take a case to court, you will need evidence to back up what you say.

The Information Commissioner and her staff will not usually take part in court proceedings commenced by you. However, if you or the defendant require someone from the Information Commissioner’s Office to give evidence, this is known as expert evidence which will only be allowed if the judge orders it. The reasonable costs of a witness would have to be met by the party calling the witness.

How much will the court award me if my claim is successful?

There are no guidelines about levels of compensation for a claim under the Data Protection Act. It will be up to the judge hearing the case  who will take into account all the circumstances, including how serious  the breach was and the impact it has on you, particularly when assessing the distress you suffered. Even when you can show the court the exact sum of money you have lost as a result of the breach of the Act, it is still up to the judge to make the award and the judge may reduce your claim or award nothing at all.

It is also important to remember that even if the court awards you compensation, the organisation may refuse, or may not be able to pay. If this happens you should ask the court about what you should do to enforce the judgment.

Court of Appeal ruling

In 2015 the Court of Appeal ruled, in the case of Vidal-Hall v Google, that compensation under the DPA could be awarded for distress alone.

Google appealed this aspect of the judgment to the Supreme Court however the appeal was withdrawn following an agreement being reached between the parties. The ICO is currently reviewing this guidance to reflect the ruling. 

Useful contacts

Citizens Advice