Six key rights UK GDPR gives you
Right to access (Subject Access Request)
You can request all personal data an organisation holds about you. Free of charge. Must be answered within 30 days. This is often the starting point for a data breach compensation claim.
Right to erasure (“right to be forgotten”)
You can request that an organisation deletes your personal data in certain circumstances — for example, if they no longer need it for the purpose for which they collected it.
Right to rectification
You can request that inaccurate personal data held about you is corrected. The organisation must respond within one month.
Right to restrict processing
You can request that an organisation stops actively using your data while a dispute is resolved, without requiring them to delete it.
Right to data portability
You can request your data in a machine-readable format and transfer it to another organisation, where technically feasible.
Right to compensation (Article 82)
If an organisation violates UK GDPR and you suffer distress or financial loss as a result, you have a statutory right to claim compensation — even without financial loss.
When can you claim compensation under UK GDPR?
Article 82 UK GDPR gives you the right to claim compensation from any organisation (called a “controller” or “processor”) that breaches UK GDPR and causes you harm. You need to show:
A UK GDPR violation occurred
For example: your data was shared without consent, accessed without authorisation, stored insecurely, or retained longer than necessary. A data breach notification letter from the organisation is strong evidence of this.
You suffered damage
Damage can be material (financial loss — e.g. identity fraud resulting from the breach) or non-material (distress, anxiety, loss of control over your personal data). Non-material damage alone is sufficient following the CJEU ruling in UI v Österreichische Post (2023).
A causal link between the violation and the damage
The distress or financial loss must result from the specific UK GDPR breach. For example, anxiety caused by knowing your medical records were accessed without authorisation.
If you can show these three elements, you have the basis for a compensation claim under Article 82 UK GDPR.
What to do if your rights are violated
Complain directly to the organisation
All organisations must have a complaints process for data issues. Start here. They must respond within 30 days.
Complain to the ICO
The Information Commissioner’s Office (ico.org.uk) is the UK’s data regulator. It investigates GDPR breaches for free. An ICO finding against an organisation strengthens a compensation claim.
Claim compensation
If the breach caused you distress or financial loss, consult a data protection solicitor about an Article 82 compensation claim. Most data breach specialists work on a no win, no fee basis.