The ICO can investigate a data breach and fine the organisation – but it cannot award the victim a penny. Compensation only comes from a civil claim under Article 82 of the UK GDPR and section 168 of the Data Protection Act 2018, which expressly covers distress. This guide explains what a claimant must prove, what Lloyd v Google changed, realistic quantum for distress-only cases, and whether your breach is a court claim, an ICO complaint, or both.
Written by John Barwell