Protect yourself after a company loses your personal data

The short version

• If your personal data is lost, stolen or seen by someone who shouldn't have it, the company must tell you if you're likely to be at high risk.
• Change any password that might have been exposed, and watch out for scam messages that use your details.
• Check your bank statements and tell your bank straight away if you see anything you don't recognise.
• Complain to the company first. It must confirm it got your complaint within 30 days.
• If the company broke data protection law and this harmed you, you can ask it for compensation, including for distress. The Information Commission can't award compensation.

What the law says

This guide covers anyone in the UK whose personal data has been lost, stolen or seen by someone who shouldn't have it. Data protection law calls this a 'personal data breach'.

If a breach is likely to put you at high risk, the company must tell you without undue delay. It has to explain what happened in clear, plain language and give you:

• a contact for more information
• the likely effects of the breach
• what it's doing to deal with the breach and limit the harm

The company decides whether the risk is high, so you might not hear from it even if your data was involved.

You have the right to complain to the company if you think it hasn't followed data protection law. The company must confirm it got your complaint within 30 days. It must also deal with your complaint and tell you the outcome without undue delay.

You also have the right to compensation from the company if it broke data protection law and this caused you damage. Damage isn't only money you've lost. The law says it includes distress.

How to protect your accounts and money

The National Cyber Security Centre (NCSC) guidance on data breaches and the Information Commission's steps to take after a breach say you should:

• change your password with the company, and on any account that uses the same password
• use extra login checks, like a code sent to your phone, if the account offers them
• check for logins or security changes you don't recognise
• check your bank statements and get a copy of your credit report

Scammers can use stolen details to pretend to be a company you trust. Don't use links or phone numbers in messages you get. Contact the company through its official website or social media channels instead. If you're not sure whether you're affected, contact the company the same way to ask.

Forward suspicious texts to 7726, which is free.

If you've lost money, tell your bank straight away. In England, Wales or Northern Ireland, also report it to Report Fraud. In Scotland, report it to the police on 101.

If documents like your passport or driving licence were involved, tell the organisation that issued them.

What you can do

1. Complain to the company. Ask what happened, what data was affected and what it's doing to protect you. The Information Commission explains how to complain to an organisation.
2. Keep a record of who you spoke to and when, and follow up phone calls in writing.
3. If you want compensation, ask the company for it in writing and say how the breach affected you.
4. If you're not happy with the company's answer, complain to the Information Commission. Include a copy of the complaint you sent to the company.

If the company won't pay compensation, you can claim through the courts. You don't have to wait for the Information Commission to finish looking at your complaint. The Information Commission recommends getting independent legal advice first, and explains how to take legal action against the organisation.

Our guide explains how to get a copy of the data a company holds about you.

Contact the Citizens Advice consumer service if you're not sure what to do next. In Scotland, get consumer help from Advice Direct Scotland. In Northern Ireland, contact Consumerline.