Can You Claim Compensation After a Data Breach?

A data breach can cause real concern, but does every breach automatically entitle someone to compensation? The UK Supreme Court is considering a related question in Michael Farley and 431 others v Paymaster (1836) Limited, which trades as Equiniti. As of 14 October 2026, the Court’s case page says “Awaiting Judgment”. No final Supreme Court ruling has been issued.

What happened in the case?

The case concerns 432 current or former Sussex Police officers whose annual pension benefit statements were sent to out-of-date addresses. The Supreme Court’s summary says the statements included personal information such as dates of birth and National Insurance numbers, as well as salary and pension details. The officers brought claims under the UK GDPR and Data Protection Act 2018.

The appeal asks whether there is a threshold of seriousness for claims seeking damages under those laws. The Court of Appeal had allowed the officers’ appeal against the striking out of most claims. The Supreme Court is considering the legal issue; its pending judgment should not be described as a decision that the claimants have already won or that every person affected by a breach will receive money.

A breach, liability and compensation are different questions

A security incident is an event that affects a system or information. A personal data breach is a security failure that leads to personal data being lost, changed, disclosed or accessed without authorisation. Whether an organisation is legally liable is a further question. A compensation claim may also need to establish that the person suffered damage recognised by law and that the relevant legal requirements are met.

The case is important because the Court’s answer may clarify the threshold for damages claims in this context. Until judgment is handed down, it is not safe to say what rule will apply. Even after a ruling, the outcome will need to be read in context: a legal test is not the same as an automatic payment for every incident, and the facts of an individual claim still matter.

If you are affected by a data breach

• Keep the organisation’s notification and record when and how you received it.
• Ask what information was affected, who may have received it and what steps have been taken.
• Take practical precautions that match the exposed data; be alert to convincing follow-up scams.
• Keep evidence of any loss, distress or time spent dealing with the incident.
• You can complain to the Information Commissioner’s Office where appropriate, but an ICO complaint is not the same as a compensation award.
• Seek independent legal advice if you are considering a claim; this article is general information, not legal advice.

The business lesson does not depend on the judgment

Organisations should reduce the chance of misdirected information through accurate records, secure delivery processes and appropriate checks before sending sensitive documents. If something goes wrong, respond promptly, preserve evidence, assess who was affected and communicate clearly. Those steps help people and support a credible investigation, whatever legal outcome follows.

For now, the precise Supreme Court question remains open. The case is a reason to follow the judgment and to handle personal data carefully—not a basis for promising that every breach leads to compensation.

When judgment is released, it will answer the legal issue before the Court; it may not settle every individual claim or establish the value of any particular person’s loss. Anyone directly affected should rely on the court’s published decision and qualified legal advice rather than predictions made before the ruling.

Sources and further reading

UK Supreme Court case page: Farley and others v Paymaster →

Related: Data-protection training lessons from a police case →

Have a technology question? Ask IT Club for free.

Ask the IT Club Advisor →