By Jo Anderson. Last Updated 30th November 2023. If your personal data has been involved in a workplace data breach, you may be eligible to receive data protection breach compensation. However, following an employer data breach, you will need to prove that the breach occurred due to your employer failing to adhere to data protection laws. Furthermore, you must have suffered financially or mentally due to the personal data breach.
In this guide, we will explain the rules and regulations all organisations must follow when processing your personal data. We will also explore how a breach of data in the workplace could occur and when you may be eligible to make a claim. Additionally, this guide will explore the types of evidence that could be used to help support your claim, and how one of our solicitors may be able to help you with your case on a No Win No Fee basis.
For free advice or to ask any questions regarding personal data breach claims, you can contact our advisory team. They are available 24 hours a day, 7 days a week to help, and can be reached by:
- Calling 0800 073 8801
- Using our live chat.
- Contacting us online.
What are my rights after an employer data breach guide
Select A Section
- Who Is Responsible For Personal Data Held By An Employer?
- Examples Of Data Protection Breaches At Work
- What Happens If An Employee Breaches UK GDPR?
- What Should An Employer Do If They Have Had A Data Breach?
- When Could You Claim For A UK GDPR Data Breach By An Employer?
- What Evidence Do I Need To Make An Employer Data Breach Claim?
- Compensation For Breach Of Data Protection
- Data Breach Claims With A No Win No Fee Solicitor
- Related Guides Explaining What Happens If An Employee Breaches GDPR
Who Is Responsible For Personal Data Held By An Employer?
There are two pieces of legislation that set out the responsibilities a data controller and data processor have to protect your personal data. These are the UK General Data Protection Regulation and the Data Protection Act 2018.
A data controller sets the purpose for processing and can process your personal data themselves. In other instances, they can outsource this task to a data processor who acts on behalf of the controller.
As a data controller, your employer has a responsibility to adhere to data protection law. If they fail to do so, you may be able to sue your employer for a breach of data. However, there are certain criteria that must be met.
Firstly, you must prove that a data processor or controller breached data protection law. Secondly, you must prove their failing led to a data breach at work which compromised your personal data. Finally, you must have suffered financial loss or mental harm.
To learn whether you could claim for a breach of data at work that affected your personal information, get in touch on the number above.
Data Protection Breach – How Long You Have To Claim
Now that we’ve discussed data protection breach examples, you could be wondering, ‘my employer has breached my confidentiality – how long do I have to claim?’.
Generally, you have six years to claim for a data protection breach. However, if your claim is against a public body, you’ll only have one year to issue court proceedings.
Get in touch if you have any queries about the limitation period. We can also answer any other questions you might have, such as, ‘I suffered harm from a breach of confidentiality in the workplace. What are my rights under the UK GDPR?’
Examples Of Data Protection Breaches At Work
Your employer is responsible for taking steps to reduce the risk of a breach of data in the workplace. If they act wrongfully in this regard and fail to protect your data, it could be exposed, and you could be eligible to claim compensation for damage this causes to you.
Some examples of data protection failures could include:
- Failure to update or provide adequate cybersecurity protection – if your employer fails to update software, it could leave systems open to hackers.
- No password requirements – If there is no password protection on documents or software that holds employee data, anyone can access it.
- Failure to protect documents – If you keep physical documents within your workplace that contain employee data, these must be kept secure. If, for example, your employer does not keep filing cabinets containing such data locked up, it could be at risk of being accessed.
- Lack of training – an accidental data breach at work could occur due to insufficient training given to staff about data protection. While on the face of it, it may seem unavoidable, if your employer has not trained staff dealing with sensitive data properly as to its protection, you could be eligible to claim compensation.
This is by no means an exhaustive list. If you’d like to check if a data breach you’ve been harmed by could lead to a claim, you can contact an advisor.
What Happens If An Employee Breaches UK GDPR?
Data breaches can happen for various reasons, one of which is human error. For example, a breach can occur if a staff member accidentally attaches a file containing an employee’s personal data to a mass email. Even though this was a mistake, it could still be considered a breach of the Data Protection Act by an employer.
At other times, criminals may deliberately cause data breaches. For example, an organisation may be the victim of a hacking attack or cyber-attack. This could lead to criminals accessing employees’ personal data. These criminals may end up using this personal data to commit identity theft or fraud. This could potentially result in financial losses for the victim.
Claimants may wonder, ‘Can I sue my employer for a breach of data protection?’ You may be eligible to claim compensation if you can prove that your employer failed to take the correct steps to protect your personal information. For more advice on starting a potential data breach claim, contact Accident Claims UK.
What Should An Employer Do If They Have Had A Data Breach?
The overseeing of data protection at work is an employer’s responsibility. They are responsible for making sure that any data their organisation collects is used lawfully.
If your data has been breached, your employer should assess the severity of the breach. They have to consider the impact the breach could have on you, and whether it could put your rights or freedoms at risk. If this is the case, the UK GDPR states that your employer must inform you of the breach without undue delay.
They will also have to inform the Information Commissioner’s Office (ICO) of such breaches as the ICO are the UK’s supervisory authority on data protection rights.
If you would like to learn more about your rights following a breach or hear about past examples of personal data breaches that have led to successful claims then please reach out to one of our advisers.
When Could You Claim For A UK GDPR Data Breach By An Employer?
You could sue your employer for a breach under the following circumstances:
- Firstly, a personal work-related data breach must have taken place and you should have been the victim.
- Secondly, you must have suffered emotional distress (non-material damages) or financial losses (material damages) or both because of the data breach.
Although victims of data breaches can claim compensation directly, many people prefer to appoint a data breach solicitor to handle their claim. The solicitor can value their claim accurately to make sure they receive the correct amount of compensation.
To discuss your potential compensation claim, call Accident Claims UK.
What Evidence Do I Need To Make An Employer Data Breach Claim?
You should provide evidence to prove that you have been affected by a data breach.
Firstly, your employer should have reported the breach to the ICO if it poses a risk to you. Your employer should have also sent you a notification about the breach. You can use this notification as evidence to prove that the data breach took place.
Secondly, you may have been psychologically injured because of the data breach. Therefore, you could use your medical records to prove your psychological injuries, such as mild cases of Post-traumatic stress disorder, for example. You should also have an independent medical assessment of your injuries and a report from that could be used as evidence.
Finally, records from your bank may be used as evidence of financial losses incurred.
Compensation For Breach Of Data Protection
If your personal data has been compromised in a breach of data in the workplace, and you are eligible to make a personal data breach claim, you could be awarded compensation for your material and non-material damage.
Any mental harm you have suffered due to your personal data being involved in a breach of confidentiality at work is referred to as non-material damage. Those calculating how much you could receive for your non-material damage may refer to the Judicial College Guidelines (JCG). This text offers guideline compensation amounts for a variety of physical and mental injuries. We have taken some of the figures from the 16th edtion of this document for our table below. However, the first entry has not been taken from the JCG.
| Type of injury sustained | Classification Of Severity | Description of injury and comments | Estimated compensation |
|---|---|---|---|
| Severe psychological damage plus financial losses | Severe | Financial losses could include loss of income due to being unable to work due to your psychological health, as well as medical costs for therapy for example. | Up to £150,000+ |
| Psychiatric Damage (General) | Severe (a) | The victim could have suffered a very severe form of psychiatric injury. They could experience problems with the issues which are highlighted above. | £54,830 to £115,730 |
| Psychiatric Damage (General) | Moderately severe (b) | The victim may have problems with factors highlighted such as work, education and relationships. This victim may have a better outlook than the person below. | £19,070 to £54,830 |
| Psychiatric Damage (General) | Moderate (c) | The person who has been affected could experience difficulties with continuing in work or education. They could also be left with problems in maintaining relationships. | £5,860 to £19,070 |
| Post-Traumatic Stress Disorder | Severe (a) | The claimant will have suffered permanent effects. | £59,860 to £100,670 |
| Post-Traumatic Stress Disorder | Moderately severe (b) | The person who has been affected will have suffered the effects and symptoms of PTSD. This person should have a better prognosis than the person below. | £23,150 to £59,860 |
| Post-Traumatic Stress Disorder | Moderate (c) | The person affected should already have fully recovered by the time of the claim. The claimant could still have some residual effects of the post-traumatic stress disorder. This should not grossly disable the claimant. | £8,180 to £23,150 |
Any financial losses you have incurred due to the personal data breach is referred to as material damage. For example, if your banking information was compromised in the breach, this could result in money being taken from your account. Providing evidence of these losses with bank statements could help support your claim.
Please contact an advisor if you would like to discuss how much your claim could be worth.
Data Breach Claims With A No Win No Fee Solicitor
After discussing your personal data breach claim with one of our advisors, they could connect you with one of our experienced data breach solicitors who could assist you. Additionally, if they agree to take on your case, they might work with you on a No Win No Fee basis with a Conditional Fee Agreement.
When working with a solicitor on a No Win No Fee basis, you won’t need to pay them any upfront legal fees. You also don’t need to pay your solicitor for their work if your case fails. Instead, a success fee is paid should your claim prove to be a success. This success fee is subtracted from the compensation awarded to you and is subject to a legal cap.
Contact our advisors today to see whether you could make a claim for a breach of data protection at work. Our friendly team is available 24/7 to offer free advice and answer your questions.
Contact our advisors today by:
- Calling on 0800 073 8801
- Using our online contact form.
- Or using our 24/7 live chat.
Related Guides Explaining What Happens If An Employee Breaches GDPR
We hope that you have found this guide to claiming compensation for an employer data breach helpful. You may find the following guides useful if you wish to claim compensation from your employer.
- Credit card data breach claims
- GP surgery data breach
- What Are My Rights After A Pharmacy Data Breach?
- Medical data breach
- What Are My Rights After A Nuffield Health Data Breach?
- What Are My Rights After A Solicitors Data Breach?
External Guides Relating To A Breach Of The Data Protection Act By An Employer And What Happens If An Employee Breaches GDPR
An ICO guide to taking your case to court and claiming compensation.
How to make a complaint about an organisation that has breached your personal data.
Government guidance on data breaches.
We hope this has been helpful to those who’ve fallen victim to an employer data breach. Now we have answered questions about what happens if an employee breaches GDPR, and ‘can my employer give out personal information?’ If you feel you could make a data breach claim for a data protection breach at work, please contact us.
