UK GDPR Rights After a Public Sector Data Breach

After a public sector data breach, UK GDPR may give you rights to find out how your data was used, ask for access or—in some circumstances—erasure, and seek compensation if the breach caused damage. A breach does not automatically mean you are owed money or that an organisation must delete every record; the outcome depends on the facts, the purpose for keeping the data and the harm suffered.

What counts as a public sector data breach?

A public authority might include a government department, council, NHS body, police force, school or other public organisation. A personal data breach is a security incident leading to accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to personal data. Examples include sending a sensitive letter to the wrong person, exposing records online, losing an unencrypted device, or allowing an unauthorised person to view a case file.

An incident is not necessarily a breach of your own data, and a breach does not by itself prove that the organisation violated every relevant legal duty. The organisation must assess the incident and take appropriate steps. Where a breach is likely to create a risk to people’s rights and freedoms, it generally must notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware. If the risk to individuals is high, it must also communicate with affected people without undue delay, subject to limited exceptions.

The ICO regulates data protection and can investigate or take enforcement action. It does not award compensation to individuals. A compensation claim is a separate route.

Access: finding out what happened

You can make a subject access request (SAR) to the public authority holding your personal data. You do not have to use a special form or mention the UK GDPR, but it helps to identify yourself, describe the information you want and give a relevant date range or service area. For example, you could ask a council for your personal data in a particular housing case file and correspondence about a specified incident.

A SAR concerns your personal data, not an automatic right to receive every document in full. The authority may provide copies or another clear way to access the information. It must normally respond within one month. It can extend the deadline by up to two further months for a complex request or multiple requests, but should tell you within the first month and explain why. If it reasonably needs identity information, the response period may not start until it receives what it needs to verify you.

Access is generally free. A reasonable fee or refusal may be possible for a manifestly unfounded or excessive request, and some information can be withheld—for example, to protect another person’s rights or because a legal exemption applies. If records contain other people’s data, the authority may redact it rather than withhold the whole record. A SAR can help establish what data was involved, who received it and what steps were taken, but it is not necessarily a full investigation report or a substitute for disclosure under other legal processes.

Erasure: when deletion may be refused

You can ask an organisation to erase personal data, but the right to erasure is not absolute. It may apply where data is no longer needed for its original purpose, you withdraw consent and there is no other lawful basis, you successfully object in circumstances where the organisation has no overriding grounds, or the data was unlawfully processed. The authority should consider the request and explain its decision.

Public bodies often have legal duties to retain records, or need information to perform a public task, comply with law, establish or defend legal claims, or meet accountability and record-keeping requirements. These can justify refusing erasure for some or all of the data. For example, a council may be unable to delete a record it must retain under a statutory duty, even if a copy was mistakenly sent to the wrong recipient. Erasure of one exposed copy also does not erase every lawful copy or undo the disclosure.

If deletion is not appropriate, ask whether the data can be corrected, access restricted, or its use limited while an accuracy or lawfulness concern is checked. You can also request an explanation of the retention period and the lawful basis for keeping the data. Retention periods vary by record type and legal context; there is no single period for all public sector information.

Compensation: what you must establish

Under the UK GDPR, a person who suffers material damage—such as financial loss—or non-material damage, such as distress, because of an infringement may be entitled to compensation from the controller or processor responsible. A data breach alone is not enough: you generally need to show an infringement, damage and a causal link between them. The circumstances and evidence matter, and compensation is assessed individually rather than paid automatically at a fixed rate.

Keep evidence that may help explain both the incident and its effects, such as the breach notification, relevant correspondence, dates, records of steps taken to reduce harm and evidence of financial loss. For distress, write down what happened and how it affected you. Avoid assuming that an apology or ICO finding automatically proves a particular amount is payable; equally, the absence of financial loss does not necessarily rule out a claim for non-material damage.

Consider first writing to the organisation’s data protection officer or complaints team. Set out what happened, the data involved, the impact on you and what outcome you seek. You may complain to the ICO if you believe data protection law was not followed. The ICO can consider regulatory issues, but cannot order an organisation to pay you compensation. A court claim is a separate option; legal deadlines and procedural requirements can apply, so obtain independent legal advice if you are considering proceedings. This is general information, not individual legal advice.

Practical steps after receiving a breach notice

1. Read the notice carefully. Check what information was affected, when the incident occurred, who may have received it and what protective steps the authority recommends.
2. Ask targeted questions. Request clarification about the categories of data, likely consequences, containment measures and whether the authority has reported the incident to the ICO, where relevant.
3. Use your rights separately and clearly. A SAR seeks your personal data; an erasure request asks for deletion on a recognised ground; a complaint asks the organisation to investigate its handling.
4. Reduce practical risks suggested by the exposed information. For example, be alert to unexpected messages that refer to the incident. Do not assume a message is genuine merely because it uses personal details.
5. Keep a dated record of communications and the impact. If the response is late or unclear, follow up in writing and consider complaining to the ICO.

Common misunderstandings and limits

“A breach means automatic compensation” is a common misconception. Compensation depends on an infringement and damage caused by it; the ICO’s regulatory role is distinct from a court’s role in deciding compensation. Another misconception is that an authority must erase any data involved in a breach. The right to erasure has defined grounds and exceptions, particularly where public functions or legal retention duties are involved.

Nor does a SAR guarantee every document in unredacted form. It provides access to your personal data, while other people’s privacy, legal exemptions and the format of records can affect what is disclosed. A refusal should not simply be ignored: ask for the legal reason, consider whether a narrower request would help, and use the organisation’s complaint process or contact the ICO if you remain concerned.

Frequently Asked Questions

Can I claim compensation for a council or NHS data breach?
Possibly, if you can establish a data protection infringement, damage and a link between them. A breach notification alone does not establish an automatic right or fixed payment.

How long does a public authority have to answer a SAR?
Normally one month. It may extend the period by up to two further months for a complex or multiple request, if it notifies you within the first month and explains the reason.

Can a public authority refuse to erase my information?
Yes. It may have a lawful basis or a legal duty to retain the information, or another exception may apply. It should explain its decision and, where appropriate, tell you about other rights.

Does the ICO award compensation?
No. The ICO can investigate data protection concerns and take regulatory action, but compensation is pursued separately, usually through agreement with the organisation or a court claim.

Should I make a SAR before claiming compensation?
A SAR can help you understand what personal data the authority holds, but it is not a compulsory step for every claim and may not provide all evidence relevant to liability or loss. Consider making focused requests and getting legal advice if needed.

Related

• Reset Quick Access Pinned Folders in Windows
• How to Enable PvP on a FiveM Server
• Black Myth Wukong Best Spirits Guide