Services A-Z     Pricing

Dealing with a Data Breach

Supporting you in the event of data breach

The financial and reputational damage caused by a data breach can have devastating consequences to businesses and organisations. Dealing with a data breach of any nature involves complex considerations. Our data breach solicitors can assist you from the moment that a breach is first identified to the conclusion of the legal processes which may follow.  

Under investigation by the ICO

In the event your organisation is investigated by the Information Commissioner’s Office (ICO), our data breach lawyers can draw upon significant specialist regulatory and criminal experience to support your organisation through the enforcement process.  We have specialist litigation expertise, both within the civil and criminal courts.

Our data protection team have a proven track record of acting in cases which attract media interest and where protection of a client’s reputation is of paramount importance. We are considered to have an exceptional breadth and depth of expertise in this complex and fast-developing area of law.

First response following a data breach

We will work closely with you from the point when a data breach is first identified in order to provide swift advice concerning your immediate obligations whilst anticipating and managing the consequences which may follow. We can assist by:

  • Advising upon your obligations to notify the ICO and data subjects within 72 hours
  • Advising upon any related notification obligations within regulated sectors
  • Managing the reputational impact of the data breach

Data breach investigation and enforcement

The ICO’s strengthened powers will be increasingly exercised to bring about compliance with data protection legislation and other information law. The ICO’s reach is broad: all individuals and organisations which obtain, share and store information about others may be investigated for breaches of the law. We can provide you with focussed legal advice and practical support if:

  • You are subject to an ICO investigation
  • You are compelled to provide information to the ICO, whether by search order, Information Notice or audit (Assessment Notice)
  • The ICO has identified data protection breaches and a regulatory outcome is being considered, such as an undertaking, Enforcement Notice or fine (Monetary Penalty Notice)

Criminal investigation for data protection offences

The Data Protection Act 2018 includes criminal offences for which both an organisation and its directors may be prosecuted. When facing a criminal investigation for data protection offences, you need the support of data breach lawyers who understand both the complexities of data protection legislation and the realities of the criminal justice system. The experience of our data protection team is set apart by the expertise of our criminal lawyers who can assist with:

Civil action in a data breach

An individual whose data rights have been breached is able to seek compensation for damage or distress caused by data breaches by application to the court. Where a data breach has impacted upon a significant number of data subjects, the risk of civil litigation may be significant and the consequences for an organisation significant. Our expert civil litigation lawyers can assess this risk immediately and assist you in mitigating the damage to potential claimants, ensuring you are prepared for any civil litigation which may follow.

 

 CONTACT OUR DATA BREACH TEAM  >

Emily Carter

Public Law

GDPR and Data Protection

Public Inquiries and Inquests

Partner

Latest blogs & news

Top five takeaways from the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (the “DUAA”), which received Royal Assent on 19 June 2025, introduces targeted reforms to the UK data protection legal framework — particularly the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

Requesting Medical Records after a death

Losing a loved one when you think it may be because they received poor medical care is incredibly stressful at a time when family and friends are grieving their loss.  Often, people want to see a written record of the final days of their loved one and what happened to them, or they might want to go through years of records to ascertain whether there was diagnosis that may have been missed, such as cancer.

Are personal details in asylum claims kept confidential? Protecting the privacy of asylum seekers and safeguarding confidentiality

Asylum seekers often find themselves in a vulnerable position, sharing sensitive and confidential information with the Home Office to support their asylum claims. Their cooperation is required to substantiate their claim and they rely on the understanding that this information will remain confidential and, most crucially, will not be shared with the authorities of their country of nationality.

The evolving challenge of data protection laws

Emily Carter explores anticipated developments in the realm of data protection.

The UK-US Data Bridge: A Shift in Transatlantic Data Sharing

On 12 October 2023, the UK-US Data Bridge (the “Data Bridge”) came into force, transforming the way both nations handle the flow of information across their borders. In this blog we explore the position before and after the introduction of the Data Bridge, looking at the key implications, benefits and challenges associated with the transatlantic data-sharing initiative.

Data Subject Access Requests: Should organisations expect the burden of responding to ease?

Emily Carter asks whether the proposed reforms within the  Data Protection and Digital Information (No. 2) Bill (‘the Bill’) are likely to simplify the challenges of responding to Data Subject Access Requests (‘DSARs’) or whether this is an area which is only going to get more complicated and time consuming.  

UK data protection reform: Some much needed clarity

After many months waiting for further clarity, Emily Carter outlines what we now know about the direction of data protection reform in the UK following publication of the Data Protection and Digital Information (no. 2) Bill.

After the Government’s consultation in September 2021 and publication of the Data Protection and Digital Information Bill in July 2022, the data reform process was paused last Autumn following the country’s change in prime minister to enable ministers to consider the legislation further. Since this time, with Michele Donelan appointed as the responsible secretary of state, there have been mixed messages with respect to how significant the further amendment to the draft bill would be. In her speech at the Conservative party conference in October, Donelan stated that the GDPR would be ‘replaced’ with a business and consumer friend data protection system, raising the prospect of an entirely new approach to data protection.

ICO regulatory update: The only constant is change Spring 2023

The Information Commissioner’s Office (ICO) regulates every organisation which deals with personal data and official data in the UK (and sometimes overseas). Its remit extends across the public and private sector, including multinationals, SMEs, public authorities and charities.

A new police approach is needed to tackle overwhelming delays to digital forensics

A damning report published by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) has found police forces to be “overwhelmed and ineffective” in relation to digital forensics. The HMICFRS found that there were more than 25,000 devices waiting to be examined – and this is without taking into account all the devices already in the system.

Data Protection reform: A new direction for charities?

Following the UK’s departure from the EU, the Government wishes to reform the data protection legislation within this country in order to ‘unlock the power of data.’ For charities, does this mean the painful prospect of reworking their existing GDPR compliance regime or the promise of a lighter regulatory load?

Data: A New Direction - Research, Re-use and Responsibility

High on the Government’s wish list for data protection reform is the reduction of legislative barriers to ‘responsible innovation,’ particularly within the field of scientific research. Due to perceived complexity and lack of clarity, it is feared that organisations either choose not to conduct research at all or rely on unnecessarily burdensome consent processes. This blog considers the likely impact of the Government’s ideas

Consultation on ICO Powers Shows the Breadth of the Regulator’s Powers

On 20 December 2021 the ICO launched a consultation seeking views on three documents, which together demonstrate its wide-ranging powers to undertake investigatory, regulatory and enforcement action.  

Data: A new direction - Access to personal data

In this blog series, we will review the key proposals for reform of data protection law within the Government’s consultation paper ‘Data: A New Direction’. We will consider how far the Government will stray from the current path and signpost some potential pitfalls and practicalities for consideration along the way

Data: A New Direction - Unleashing the transformational power AI?

In this blog series, we will review the key proposals for reform of data protection law within the Government’s consultation paper ‘Data: A New Direction’. We will consider how far the Government will stray from the current path and signpost some potential pitfalls and practicalities for consideration along the way.

Data protection law reform: A new direction?

In this blog series, we will review the key proposals for reform of data protection law within the Government’s consultation paper ‘Data: A New Direction’. We will consider how far the Government will stray from the current path and signpost some potential pitfalls and practicalities for consideration along the way.

We begin with the Government’s proposals for creating a ‘whitelist’ of legitimate interests which always provide a lawful basis for processing under the UK GDPR. 

The UK’s Data Protection Reform Consultation – Good News for Employers?

On 10 September 2021 the UK Government launched a Consultation on proposed changes to data protection law with the aim to “create a more pro-growth and pro-innovation data regime, whilst maintaining the UK’s world-leading data protection standards”. The proposals are designed to build on the UK’s existing data protection regime (contained in the General Data Protection Regulation (as it applies in the UK post-Brexit) (UK GDPR) and the Data Protection Act 2018).

What is Next for GDPR in the UK, is Change on the Horizon?

The General Data Protection Regulation (known to everyone as the GDPR) is probably the most famous piece of legislation to come from the EU. It was and is incredibly ambitious in its scope, and shapes the way we engage with organisations both online and in the real world. When the UK formally withdrew from the EU, GDPR became retained EU law and continued to apply as before. The government have recently announced that they want to reform data protection legislation, but substantial deregulation might be an unrealistic ambition.

ICO enforcement action – key considerations for charities in the GDPR era

It is now more than two years since the Data Protection Act 2018 and GDPR came into force, significantly increasing the enforcement powers of the Information Commissioner’s Office (ICO). With the passing of the Act, the ICO gained the power to issue fines amounting to millions of pounds and increased powers to bring criminal prosecutions against organisations who fail to comply with the data protection regime.

COVID-19 and contact tracing apps: A test of public confidence in data privacy?

Dominic Raab announced last week that the current UK lockdown would last for at least another three weeks. These restrictions are unlikely to be relaxed until a large scale plan is in place to track and restrict the spread of the virus. Part of this plan will involve the use of the NHS “contact tracing” app, which we have been told is in an advanced stage of development.

ICO enforcement – key considerations for businesses and organisations in 2020

On 23 May 2020, it will be two years since the Data Protection Act 2018 came in to force. The Act was brought in to compliment and supplement GDPR, and significantly increased the ICO’s enforcement powers. In the build-up to its commencement, there was a flurry of speculation about how these new powers would be used. We now look at the how the ICO has used its enforcements powers in 2019 and highlights key considerations for businesses and organisations in 2020.

Data Protection Insights

View all

Blogs

The UK-US Data Bridge: A Shift in Transatlantic Data Sharing

ICO enforcement action – key considerations for charities in the GDPR era

ICO enforcement – key considerations for businesses and organisations in 2020

Data protection for your business after a no-deal Brexit

Overhaul of SARS regime to be welcomed

How to respond to a subject access request: a step by step guide for organisations

Our current Brexit options and the consequences for UK data protection law

Care homes take heed: if you have failed to pay the ICO data protection fee you could be breaking the law

GDPR and Brexit: the draft withdrawal agreement and data transfers from the EU

Data Protection Act 2018 and law enforcement: an introduction

The Data Protection Act 2018: new criminal offences for data breaches

Data breach reporting – the only way is up

Joint data controllers – yet more data protection uncertainty

Some welcomed guidance for data controllers: Court of Appeal confirms the correct test to be applied when considering a SAR concerning mixed data

GDPR: The significance of the new principle of accountability

GDPR: A guide for therapists

The Data Protection Bill - New Criminal Offences for Data Protection Breaches On Their Way to the Statute Book

Subject Access Requests under the GDPR: What employers need to know

Data protection: A new board room priority

Close Load more

Skip to content Home About Us Insights Services Contact Accessibility