ICO data breach notification to compensation claim: complete 2026 workflow

Instead of repeatedly chasing a breach notice, build an ICO data breach notification compensation claim file that separates regulatory reporting from your request for compensation. Preserve the notice, complain to the organisation, record the harm and seek Scottish legal advice without waiting for an ICO outcome.

Why this matters

An ICO report does not start a compensation claim. The Information Commissioner’s Office investigates data protection concerns, while compensation requires a separate agreement or court claim. You do not receive damages simply because an organisation reports a breach.

For individuals considering their next move in 2026, the useful distinction is between evidence of an incident and evidence of a compensable wrong. A notification helps establish what happened, but you also need to identify the alleged infringement, resulting harm and connection between them.

Thompsons Scotland provides compensation-claim advice to individuals across Scotland. Establish whether your circumstances fall within the firm’s services before sending sensitive records.

Before you start

• Gather your materials: retain the original notification, correspondence, relevant account records and a private chronology. Keep originals separately from any working copies you annotate.
• Confirm the right contact: identify the organisation responsible for the affected information and its published privacy or data protection contact. Verify unexpected messages through an independently obtained contact channel.
• Avoid the deadline trap: the UK GDPR Article 33 reporting period of 72 hours concerns the controller’s notification to the ICO where required. It is not your compensation deadline, and an ICO complaint does not automatically stop a court time limit.

You do not need an organisation’s ICO login or access to its internal incident system. This is an individual’s evidence-and-complaint workflow, not an organisation’s breach-reporting procedure.

Establish the incident record

Preserve the notice

1. Save the original email, letter or message, including attachments and available sender details. Keep the envelope if it helps establish when a letter arrived.
2. Create a chronology with the headings Incident date, Discovery date, Notification received and Action taken. These are headings for your own record, not fields in an ICO form.
3. Record the organisation’s exact description of the information affected. Separate confirmed exposure from information still under investigation.
4. Note any incident reference and the contact named for questions. Do not treat the absence of an ICO reference as proof that no report exists.

Expected result: you have an unchanged source notice and a chronology that distinguishes the incident from the date you learned about it.

Separate reporting duties from your rights

Under UK GDPR Article 33, a controller must notify the ICO without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Article 34 requires communication to affected individuals without undue delay where the breach is likely to result in a high risk, subject to statutory exceptions.

These are different thresholds. An organisation’s notification to you does not prove that every legal requirement was breached, and silence does not establish that your information was unaffected.

For your 2026 file, record what the notice actually confirms: the data involved, the incident description, the likely consequences and the protective measures described. Mark unanswered questions separately rather than filling gaps with assumptions.

Build the organisation complaint

Prepare your written questions

1. Identify yourself using the minimum information needed to locate the affected account or record. Ask for a secure method before sending identity documents or sensitive attachments.
2. State when you received the notification and quote its reference. Explain briefly why you believe your information is involved.
3. Ask what personal data was affected, whether it was accessed or disclosed, and what the organisation can confirm about recipients or access.
4. Request an explanation of the measures taken to contain the incident and protect your information. Ask for a written response and complaint reference.
5. Explain any harm already experienced, distinguishing confirmed losses from concerns about future misuse.

Expected result: your complaint gives the organisation specific issues to answer and creates a dated record of your concerns.

Request records for a defined purpose

A subject access request is separate from a complaint. Under UK GDPR Article 15, it concerns access to your personal data and associated information; it is not a general right to the organisation’s entire investigation file.

For example, request personal data contained in communications about the disclosure affecting you. Do not assume that this gives you access to privileged legal advice, other people’s information or every security document.

The usual Article 12 response period is 1 calendar month, although lawful extensions and other timing rules can affect the calculation. Keep the request and acknowledgement, and obtain advice if the response is delayed or incomplete.

A focused request makes the response easier to assess. Asking for everything without identifying the information you need creates a larger review task without necessarily answering your central question.

Record harm and choose the appropriate route

Create an evidence schedule

1. Add a Financial loss entry for each relevant transaction or expense. Retain statements, receipts and correspondence, and explain why you connect the loss to the breach.
2. Add a Distress entry describing what you experienced, when it began and how it affected daily life. Use factual descriptions rather than legal terminology.
3. Preserve relevant medical records if you sought treatment. Seek care because you need it, not to manufacture evidence for a claim.
4. Record protective action, including account security changes, bank notifications and reports of suspected misuse. Retain reference numbers without recording passwords in your claim file.
5. Keep unrelated events separate. A transaction occurring after a breach is not, by timing alone, proof that the breach caused it.

Expected result: your file connects each alleged consequence to supporting material instead of relying on a general statement that the breach was upsetting.

UK GDPR Article 82 recognises compensation for material and non-material damage resulting from an infringement. An infringement alone does not establish an entitlement to compensation: damage and a causal connection still need assessment.

Compare the routes

The following distinction applies to a 2026 claim file. An organisation complaint can support either route, but regulatory action and compensation serve different purposes.

Neither route guarantees the outcome you want. An ICO finding can be relevant evidence, but it does not automatically determine the value or success of a civil claim.

Escalate with a defined request

Give the organisation an opportunity to address your complaint before escalating it to the ICO. Preserve its response, or evidence that you pursued a response, alongside the original notification.

ICO guidance asks individuals to raise concerns within 3 months of their last meaningful contact with the organisation. This is the regulator’s complaint guidance, not a Scottish court limitation period; check the current guidance when submitting in 2026.

Describe what remains unresolved and attach relevant evidence rather than an unfiltered archive. Ask the ICO to consider the data protection concern, not to calculate or award compensation.

Prepare the Scottish legal handover

Assemble a reviewable file

1. Put the notice, chronology, organisation complaint, response and any ICO correspondence together. Keep documents in date order with clear filenames.
2. Add your evidence schedule and supporting records. Identify disputed facts and explain which questions remain unanswered.
3. Tell the solicitor about any settlement proposal, release, previous claim or existing legal representative. Do not accept terms you do not understand.
4. Ask which organisation would be the proposed defender and what legal basis supports a claim. The sender of a notification is not automatically the only relevant party.
5. Ask for advice on the applicable deadline, Scottish court route, funding arrangements and exposure to expenses before authorising proceedings.

Expected result: the solicitor can assess the parties, alleged infringement, harm, causation and procedural risks from an organised record.

Do not wait for an ICO conclusion before checking your legal deadline. Scottish prescription and limitation questions depend on the claim’s legal basis and facts; the organisation’s reporting deadline cannot answer them.

Thompsons Scotland’s stated role is compensation advice for individuals across Scotland. Its suitability for a particular data protection dispute, the representation available and the proposed terms need confirmation before instruction.

Update the file whenever new evidence arrives

A second workflow applies when an organisation revises its notification, your bank identifies misuse or the ICO sends correspondence. Update the existing record rather than starting a disconnected complaint.

• Preserve the update: save the new document separately and retain earlier versions.
• Identify the change: record whether it changes the affected information, incident dates, alleged consequences or organisation’s explanation.
• Review protective action: follow appropriate security advice through verified channels and keep a record of the action taken.
• Notify your adviser: send the update with a short explanation of its relevance, especially where it concerns a deadline or settlement proposal.

Do not silently replace an earlier account with a corrected one. The sequence of explanations can matter when assessing what was known and when.

For a continuing incident in 2026, keep new suspected losses separate from established losses until the supporting records clarify the connection.

Troubleshooting

The organisation says it reported the breach, but offers no compensation

Reporting to the ICO addresses a regulatory duty; it does not resolve a damages claim. Ask the organisation to respond separately to your allegation of harm and request legal advice on the response.

The ICO has not finished considering the complaint

Continue preserving evidence and check your court deadline independently. Waiting for the regulator is not a substitute for obtaining limitation advice.

You have distress but no financial loss

Financial loss is not the only category recognised by Article 82. Record the distress accurately and seek advice on whether the evidence establishes compensable non-material damage caused by the infringement.

You cannot identify the information exposed

Ask the organisation for a clear description of the affected data and the limits of its investigation. A targeted subject access request can help obtain your personal data, but it does not replace those questions.

A claims message asks for sensitive documents

Verify the sender independently before responding. Do not send identification, medical records or banking documents through an unverified link merely because the message mentions a real breach.

Customize your workflow

Keep the same core file, but adapt the evidence to the information involved. Financial information calls for relevant transaction records; medical or employment information calls for careful handling of sensitive documents and a clear account of disclosure-related harm.

Before appointing a representative, use the guide to data breach compensation solicitors in Scotland to frame questions about relevant experience, responsibility for the file and claim terms.

Keep your evidence file separate from your everyday inbox. Restrict access, preserve originals and use a secure transfer method agreed with your adviser.

FAQ

One last thing

Keep the first notification even when a corrected notice arrives. A later explanation does not erase the earlier document, and preserving both gives your adviser a clearer chronology. For a claim considered in 2026, that documentary sequence is more useful than a reconstructed account written from memory.

Related guides

• Workplace accident book entry to compensation claim workflow
• DWP benefit statements to compensation settlement workflow