My data was leaked in a data breach: can I claim compensation?

A short email saying "your data may have been affected" is where most people stop. You do not have to. In the EU and the UK, the GDPR lets you ask the company exactly what happened, and it must answer within one month. If the breach caused you damage, you can claim compensation under Article 82. That covers money you lost and non-material harm, including fear that your data will be misused. A breach on its own is not enough: you have to show the damage.

What the company owes you after a breach

When a breach is likely to put you at high risk, the company must tell you without undue delay, in clear and plain language. The notice must say what the likely consequences are, what it has done about the breach, and who you can contact, such as its data protection officer.

It must also report the breach to its data protection authority within 72 hours of becoming aware of it, unless no risk is likely.

You can then ask for more. Under Article 15 you can get a copy of the data the company holds about you, who it was shared with and where it came from. The company must reply within one month. It can extend that by two months for complex requests, but it must tell you within the first month and say why.

When you can claim compensation

The Court of Justice of the EU set out the test in 2023. You need three things together:

• An infringement of the GDPR, such as security that was not good enough to protect your data.
• Damage: money you lost, or non-material harm.
• A link between the two: the damage came from the breach.

There is no minimum level of seriousness for non-material damage. But the court was clear that a breach does not pay out by itself. You have to show what it did to you.

"We were hacked" is not the end of it

Companies often answer that they were the victim of a criminal attack. The court looked at exactly that in December 2023, after a hack of the Bulgarian tax agency.

• Fear counts. Fear of possible misuse of your data can in itself be non-material damage.
• The burden is on them. The company must prove its security measures were appropriate.
• A hack is not proof either way. It does not show by itself that their security failed, and it does not let them off.

Under Article 82(3), the company escapes liability only if it proves it was not in any way responsible.

In the UK, the UK GDPR has the same Article 82, but UK courts are not bound by these EU rulings, so they decide the test for themselves.

Who to complain to

You can complain to the data protection authority in the country where you live, where you work, or where the breach happened.

Country	Data protection authority
France	CNIL
Germany	The data protection authority of your federal state (the BfDI at federal level)
Spain	AEPD
Italy	Garante per la protezione dei dati personali
Portugal	CNPD
Netherlands	Autoriteit Persoonsgegevens
Poland	UODO
Belgium	APD-GBA
Ireland	Data Protection Commission
UK	Information Commissioner's Office (ICO)

The authority can investigate and order the company to act. It does not award compensation. That comes from the company, or from a court.

How to claim, step by step

1. Secure yourself first. Change the passwords that were exposed, turn on two-step login, and tell your bank if card or bank details were involved.
2. Keep everything. The breach notice, every scam text, call or login attempt since, and receipts for any cost.
3. Keep a short diary. Date, what you did, how long it took and how it affected you. This is your evidence of non-material damage.
4. Write to the data protection officer. Ask what was affected, when, what they did and whether they reported it. Ask for a copy of your data.
5. Claim in the same message. Name Article 82, set out your damage and say what amount you claim. The amount is your choice: base it on your receipts and an honest account of the effect.
6. Give a date. One month, as Article 12(3) requires.

The message to send

Subject: Personal data breach notice of 14 October 2026: request for information and compensation

I am a customer of yours (customer number 4471920). Your email of 14 October 2026 says my personal data was affected by a breach of your systems.

Under Articles 15 and 34 of the GDPR, please tell me exactly which of my data was affected, when the breach happened and when you became aware of it, what you have done to contain it, and whether and when you reported it to the data protection authority. Please also send me a copy of the personal data you hold about me.

Since the breach I have received four phishing texts using my name and order details, and spent about four hours changing passwords and checking my accounts. Under Article 82 of the GDPR I claim compensation of €300 for the distress and time this has caused.

Please reply within one month, by 14 November 2026, as Article 12(3) requires.

Swap in your own details. Attach the notice and your screenshots.

Time limits and what to do if they refuse

• No reply after one month: send a short chase with a final date 14 days away.
• A refusal or a low offer: send a formal complaint. Quote Article 82(3) and the court's 2023 rulings, and ask for their final position in writing.
• Still no: complain to the data protection authority, and for compensation, go to court. You can sue where the company is established or where you live. Small claims procedures exist for smaller amounts, and the European Small Claims Procedure covers a company in another EU country.
• Court deadlines are set by each country's law. Check yours before you wait too long.

If many people were affected, ask a consumer organisation whether a group claim already exists.

The short version

Ask the company what happened to your data and get a copy within one month. If the breach cost you money, time or peace of mind, claim compensation under Article 82 with your evidence. "We were hacked" is not a defence on its own. If they refuse, complain to the data protection authority and take the claim to court.

Questions

How much compensation can I get for a data breach?

The GDPR sets no fixed amounts, so courts in each country decide. Your real costs count in full, and for distress the amount depends on what you can show about how the breach affected you.

The company says no one has misused my data yet. Can I still claim?

Yes. The Court of Justice of the EU ruled that fear of possible misuse of your data can in itself be non-material damage, but you still have to show that you suffered it.

Will the data protection authority get me compensation?

No. The authority can investigate and order the company to act, but compensation comes from the company itself or from a court if it refuses.

They offered me free credit monitoring. Should I accept?

It is useful protection, but it is not compensation for damage you have already suffered. Read the offer first: if it says it settles your claim, accepting it ends the claim.

General information, not legal advice. Rules change and depend on where you live: check the official source before you rely on a date or an amount.

Sources

• GDPR, Regulation (EU) 2016/679, Articles 12, 15, 33, 34, 77 and 82 (EUR-Lex, checked October 2026)
• Court of Justice of the EU, Case C-300/21, 4 May 2023 (checked October 2026)
• Court of Justice of the EU, Case C-340/21, 14 December 2023 (checked October 2026)
• European Data Protection Board: national data protection authorities (checked October 2026)