By Danielle Graves. Last Updated 23rd July 2023. Recent changes in the law mean that you are in a better position than ever to claim compensation from those who breach your data and cause you harm. If this happened to you, this article will explain the question – how do I report a data protection breach?
In 2018 the law changed around data protection. The introduction of the General Data Protection Regulation (GDPR) means that any organisation, company or agency that collects your data must do so for specific reasons and handle it with care. These laws are upheld by an independent organisation called the Information Commissioners Office (ICO) which has tremendous power to enforce compliance and issue fines if your data is not handled properly.
Breaches in data protection can cause all manner of problems for the people they affect. It’s so much more than just a few unwanted spam emails or text alerts you did not sign up for. A data breach can result in your entire identity being stolen and if you have been touched by issues like this, you may be wondering what you can do.
If you have questions you’d like answered right now, please feel free to contact our team. We specialise in helping people clarify their options around launching data breach compensation claims and can connect you with a data breach solicitor from our panel within minutes.
Simply start your claim by calling our team direct on 0333 000 0729 or writing/emailing us at Legal Helpline. You can also use the ‘live support’ option, the bottom right to get on-the-spot guidance about reporting a data breach.
How do I report a data protection breach guide
Select A Section
- How Do I Know If My Data Privacy Was Breached?
- What Data Protection Breaches Could I Report To The Information Commissioner?
- How Do I Report A Data Breach To The Information Commissioner?
- How To Report A GDPR Breach To A Data Controller Or Processor
- What Happens When I Report A Data Protection Breach?
- How Long Do I Have To Report A Data Breach?
- Claiming For A Data Breach With A No Win No Fee Solicitor
- Where To Learn More
How Do I Know If My Data Privacy Was Breached?
Before we answer the question – ‘how do I report a data protection breach?’ it’s important to explain how the breach may first come to your attention. It’s a legal requirement for companies and organisations to tell you as soon as possible if they think your data may have been hacked or otherwise compromised. In addition to this, the company itself has a legal obligation to report the breach to the ICO (within 72 hours) and may or may not investigate.
Perhaps you received a letter or an email from a company or agency alerting you to a breach. You may have heard about it from social media, news outlets or other involved parties. However it came you your attention, you have a step-by-step procedure that can help you report the breach and obtain compensation for any negative repercussions that arise from it. There are three basic types of breach:
- Integrity – the unauthorised or accidental alteration of data. Cases where the data is changed without consent.
- Confidentiality – the unauthorised or accidental disclosure of information. When your privacy is broken.
- Availability – loss or destruction caused accidentally or deliberately. This could be someone deleting your details without consent.
It’s important to note that these actions are deemed breaches if they fall outside of the pre-agreed terms of original use. You may become aware of a data breach in a different manner. Perhaps money starts to disappear from your account or there is a sudden increase in spam emails and cold calls.
Worse still, your name could be implicated in fraud or crimes you are totally unaware of. Identity theft is horrendously damaging both financially and emotionally for the victim. Events such as these will undoubtedly alert you very quickly to a problem.
What Data Protection Breaches Could I Report To The Information Commissioner?
You can report any kind of data breach to the ICO. The purpose of the ICO is to monitor and enforce data protection law in the UK, and part of this is taking reports of breaches and potential breaches.
Even if the breach doesn’t meet the criteria to make a compensation claim, you can still report it to the ICO. This is because the ICO does not provide compensation and doesn’t judge whether or not you can make a valid claim.
Data controllers and processors are required to report notifiable breaches to the ICO. This means any kind of data breach that could affect the rights or freedoms of those involved. The maximum time for reporting a serious data breach to the ICO is 72 hours.
It’s important to note that the ICO won’t investigate every complaint or report that they receive. However, it can still be worthwhile to make a report. For data controllers and processors, you could face a fine if you fail to make a report in time.
Keep reading to learn about the data breach reporting time and how long you have to report a breach. Or, get in touch with our helpful team to find out how reporting a breach could help you through the claims process.
How Do I Report A Data Breach To The Information Commissioner?
Once it has come to your attention that you are the victim of a data breach, there is a step by step procedure to follow to report it.
- Firstly, contact the agency or organisation that breached your data with a complaint in writing. The ICO offer a template letter you can use.
- Allow a period of no longer than three months to receive a meaningful response from this organisation. They may try to deny the breach or your involvement in it. The three month period is important as after that, it can be difficult for your case to be taken seriously by the ICO.
- Without a meaningful or helpful response, ask the ICO to step in. The Commissioner will not automatically take up your case but if it’s a serious breach that has affected people badly they can apply pressure on the company in question to explain it. Their involvement lends your case weight and you can refer to their website to see how the company is being monitored or what penalties are being imposed against them.
- The ICO does not pay compensation. To start a claim for that, you need to start a private case against the organisation.
How To Report A GDPR Breach To A Data Controller Or Processor
People often ask us how to report a GDPR breach to the person or body responsible for breaching their data. Although those responsible are obligated to inform you of a data breach, there are a few reasons why they may not. For instance, they may simply not be aware that a breach has occurred.
When you report a breach of data protection, you may be tempted to do so over the phone. You may feel that this will get you quicker results. However, there is a chance there will be no record of the call. This could potentially lead to the data controller in question denying ever being aware of the data breach or being made aware of it when it came to claiming.
It is better to notify the data controller or processor of a data breach via email. This way, you can prove that you sent the email if you should need to during your claim. Whilst you can then follow up this email with a phone call if you wish, you will then have proof of notification.
If you need more information, get in touch with our advisors today.
What Happens When I Report A Data Protection Breach?
There is a three month period from complaining in writing to the last meaningful contact with the organisation in question. Failure to receive a meaningful response may mean you decided to take your grievance further. You can use this time to build evidence with a view to starting a private case for compensation for the data breach.
You do not have to involve the ICO at all and you do not have to use the services of a data breach solicitor. But both can make the argument for recompense stronger and lend more credibility to your compensation claim. As you wait for the outcome of the ICO’s investigation, use the time to consider starting a claim with a No Win No Fee data breach lawyer.
How Long Do I Have To Report A Data Breach?
If your personal data has been involved in a UK GDPR breach, you may be wondering, ‘How long do you have to report a data breach?’
If you discover that your personal data has been compromised, you should report the breach to the organisation responsible as soon as possible. You could also ask them to clarify exactly what personal information was involved in the breach.
Additionally, you could report the data breach to the ICO. They could then choose to investigate the breach, and their findings could be used as evidence in your data breach claim. However, you must do this within 3 months of your last meaningful communication with the organisation responsible regarding the breach.
Organisations also have time limits they must adhere to when reporting a data breach. Firstly, they must report the breach to the ICO within 72 hours of discovering it. Furthermore, they must inform you without undue delay if your personal data has been involved in a breach, if they believe your rights and freedom may be at risk.
If you have any questions about what to do following a data protection breach, please get in touch with our advisors using the details at the top of the page.
Claiming For A Data Breach With A No Win No Fee Solicitor
If you are eligible to make a personal data breach claim, you may wish to have a solicitor to support your claim. One of the data breach solicitors from our panel could work on your case on a No Win No Fee basis under a Conditional Fee Agreement.
When your solicitor works with you under this type of agreement, they won’t ask for you to pay any upfront or ongoing fees for their services. You also won’t be asked for a payment towards their work on your personal data breach claim if you’re not awarded compensation following an unsuccessful case.
However, should your claim prove successful, your solicitor will deduct a success fee from your award. The amount that can be taken as this fee is a legally capped percentage.
If you have any questions or to find out if you may be eligible for compensation, speak to an advisor from our team. They’re available with free advice 24/7. In addition, if it seems like you are eligible to seek data breach compensation, they could connect you to one of the solicitors from our panel.
To talk to an advisor:
- Contact us online.
- Call 0333 000 0729
- Use our live chat feature.
Where To Learn More
Our website offers further advice on GDPR data breach compensation claims. You can read here about what to do if the NHS breached your data. Or if you were the victim of a data protection problem at a bank. You might find this link about victim support for data breaches helpful, also.
Thanks for reading our guide that sought to answer the question, how do I report a data protection breach?
