Last Updated: 23rd July 2025. This is a guide to examining whether you could make a claim if a journalist data breach compromises your personal information. To make a personal data breach claim, there must have been failings on the part of the media organisation that the journalist works for to comply with data protection laws. There are 2 pieces of legislation under which organisations have a responsibility to protect personal data:
- The UK General Data Protection Regulation (UK GDPR)
- The Data Protection Act 2018 (DPA)
Continue reading to learn more about the responsibilities media companies have to keep your personal data safe.
You can also contact a member of our team at any time for free and confidential advice regarding personal data breach claims. They can provide insight into whether you could be eligible to receive data breach compensation.
4.8 (466 reviews) To do this:
- Call our advisors on 0800 073 8804
- Contact us by filling in our online form
- Write to an advisor using the live chat feature below
What Is A Journalist Data Breach?
First, to define a personal data breach, we must explain what is meant by personal data. To do this, we will examine the definition provided by the Information Commissioner’s Office (ICO), an independent UK body responsible for upholding personal data rights. Personal data is any information that can be used to identify you, either directly or indirectly. This includes your:
- Name
- Date of birth
- Phone number
- Email address
- Home address
Furthermore, Article 9 of the UK GDPR also outlines a second category of personal data called special category data, which is more sensitive and therefore necessitates extra protective measures. This involves data relating to your:
- Philosophical and religious beliefs
- Political opinions
- Race and ethnic origin
- Health, such as medical records
- Sexual orientation
A personal data breach is broadly defined by the ICO as a security incident affecting the confidentiality, availability or integrity of personal data. To learn whether you could be eligible to bring forward a personal data breach claim, please speak to a member of our team.
How Could A Media Company Breach Your Personal Data?
Under data protection laws, organisations are required to protect the personal data they handle. Failure to keep this data secure in line with data protection laws can make them liable should a breach occur and cause a data subject harm.
But how could a personal data breach occur?
- An individual sends your personally processed data to the wrong address.
- The wrong fax or email is used when sending personal information
- A device containing personal data is lost or stolen as the organisation fails to keep it secure.
- If there are inadequate cybersecurity defences, then cyber criminals can hack databases and steal personal data.
If your personal data has been breached, resulting in you suffering mental injury or financial losses, please speak to a member of our team.
How To Prove A Media Company Breached Your Personal Data
There is a process you can follow after a data breach compromises your personal data and causes you harm. Media organisations should notify the ICO within 72 hours of discovering a data breach that puts the rights and freedoms of those affected at risk. They should also inform you without undue delay.
In these circumstances, or in the event that you have not been notified but suspect a breach has occurred that compromises your personal data, you could take the following steps:
- First, contact the media organisation directly and enquire about the data breach.
- Then, if they respond in a non-satisfactory way, you may want to make a complaint to the ICO. Should they investigate your complaint, any findings could be used as evidence to strengthen your claim. The ICO cannot award compensation.
- At the same time, we recommend that you seek legal advice.
To learn more about proving a journalist data breach, please speak to our team of advisors. They are available 24/7 to provide legal advice at no cost.
Could I Claim For A Journalist Data Breach?
The UK GDPR creates an avenue for people harmed due to a personal data breach to pursue a claim for compensation. Article 82 outlines the criteria of eligibility that must be met to bring forward a claim. This is as follows:
- There must have been failings on the part of those responsible for handling your personal data to comply with data protection laws, which led to a breach.
- This breach must have involved your personal data being compromised.
- As a result, you suffered either psychological injury or financial losses (or both).
Please be aware that journalism is exempt from parts of the UK GDPR, so to learn whether you could be eligible to bring forward a claim, please speak to one of our advisors. They can offer insight into eligibility, liability and the claims process in general.
What Damage Could You Claim For After A Media Company Data Breach?
The damage you could for after a media company data breach can comprise:
- Non-material damage – The mental harm you suffer due to the personal data breach. This could include stress, anxiety, depression and, in severe cases, post-traumatic stress disorder (PTSD)
- Material damage – The monetary loss incurred as a result of the personal data breach. That encompasses the cost of extra home security, therapy, lost earnings, or even the need to relocate. It is important that you retain evidence, such as bank records or payslips.
We have referred to the Judicial College Guidelines (JCG) to provide the table below. Data breach solicitors and other legal professionals can refer to the JCG to assist them in valuing the psychological harm suffered by claimants. That is because this document publishes a wide range of suggested compensation brackets for various forms of harm.
Please note that the top row isn’t from the JCG, nor do the brackets guarantee compensation.
| Harm | Compensation Guidelines |
|---|---|
| Multiple Instances of Severe Psychological Harm and Financial Losses (e.g. Cost of Therapy) | Up to £250,000+ |
| Psychiatric - Severe (a) | £66,920 to £141,240 |
| Psychiatric - Moderately Severe (b) | £23,270 to £66,920 |
| Psychiatric - Moderate (c) | £7,150 to £23,270 |
| Psychiatric - Less Severe (d) | £1,880 to £7,150 |
| PTSD - Severe (a) | £73,050 to £122,850 |
| PTSD - Moderately Severe (b) | £28,250 to £73,050 |
| PTSD - Moderate (c) | £9,980 to £28,250 |
| PTSD - Less Severe (d) | £4,820 to £9,980 |
For further information, you can use our compensation calculator or speak to an advisor for tailored guidance on pursuing compensation.
How Can Journalists Keep Personal Information Secure?
Journalists must take appropriate measures to keep personal information secure and safe. To support the media’s compliance with data protection laws, the ICO has published a journalism code of practice. This code provides guidance on applying data protection laws within the context of journalism, such as:
- Preparing a backup system to restore any lost data.
- Demonstrating how personal data will be safeguarded.
- Maintaining a record of security incidents and notifying the ICO if there are any imminent concerns about a journalist breach of data.
- Informing those who are likely to be affected by the personal data breach (unless a journalism exemption applies).
- Providing appropriate training to staff to avoid any journalist data breach.
- Conducting a data protection impact assessment (DPIA) if there is a likelihood of high risk.
- Reviewing and updating security measures regularly, such as scanning for network vulnerabilities.
- Ensuring there are secure physical locations and appropriate cybersecurity measures in place, such as password protection and encryption.
- Maintaining secure IT equipment on portable devices for remote work or travel.
These represent only a snapshot of the many ways in which journalists and media organisations can comply with data protection laws. If you’d like tailored guidance on how to make journalist data breach claims, please contact our advisors now and keep reading this guide.
How To Claim For A Personal Data Breach
For an assessment of your claim and advice on the future steps you could take, please speak to one of our advisors. Should they find that you may have valid grounds to claim for a journalist data breach, they could place you in contact with one of our experienced solicitors, who could offer to represent you under a type of No Win No Fee arrangement called a Conditional Fee Agreement (CFA).
Signing a CFA means you wouldn’t be charged any solicitor fees upfront, during the ongoing claim, or in the event your claim does not succeed.
On the other hand, a successful claim will result in a No Win No Fee data breach solicitor receiving a small percentage of the compensation. This success fee is for the work done on your case and is kept small as the percentage is capped by legislation.
To speak to our team at Legal Expert today, you can:
- Call us on 0800 073 8804
- Contact us by filling in our online form
- Write to an advisor using the live chat feature below
Similar Data Breach Claims
Please explore more of the guides on our site:
- Find out what your rights are if your personal data has been lost after a breach
- See what you can do if your data has been breached
Also, take a look at these helpful external sources:
- ICO – Data protection and journalism
- GOV.UK – Cyber Security Breaches Survey 2025
- NHS – Mental health overview
Thank you for reading this guide to making a claim for the harm you have suffered due to a journalist data breach.
