GDPR Compensation Claims: Suing for a Data Breach

Irish courts can award damages when your data rights are infringed — including for distress and upset. Here is how these claims actually work.

When an organisation infringes your data protection rights — leaks your data, discloses it to the wrong people, uses CCTV of you unlawfully, ignores your rights — the GDPR gives you a right to compensation for the damage you suffer, and the Data Protection Act 2018 lets you sue for it in the Irish courts through what section 117 calls a data protection action.

This area attracts noise. You will read online both that data breach claims are free money and that they are worthless. Neither is true. Irish and EU case law has settled into a middle position: compensation is genuinely available, including for non-material damage like distress and anxiety — but there must be actual damage proved, not a bare infringement, and awards for ordinary cases are modest. We set out the honest picture below.

What you must show

Three elements: an infringement of the GDPR or the 2018 Act in how your data was handled; damage — material (financial loss) or non-material (distress, anxiety, reputational harm); and a causal link between the two. The European Court of Justice has confirmed that no minimum threshold of seriousness applies to non-material damage, but also that infringement alone is not damage — you must prove the harm, even if it is emotional rather than financial.

Evidence of non-material damage matters more than claimants expect: contemporaneous complaints, medical attendance where genuine, the practical consequences of the disclosure (who saw what, and what followed). A claim that says only that rules were broken tends to fail; a claim that shows what the breach did to you tends to succeed.

What Irish courts have actually said

The leading Irish authority on non-material damage is the Circuit Court's decision in Kaminski v Ballymaguire Foods, which concerned workplace CCTV footage of an employee shown in a training session. The court confirmed that compensation for non-material damage is available, that it must go beyond mere upset or displeasure at the infringement itself, that damages in ordinary cases will be modest, and that supporting evidence matters. The award in that case was in the low thousands of euro, and the judgment set out guidance the courts have applied since.

That calibration is the single most important fact for anyone considering a claim: genuine, provable distress from a real breach is compensable; annoyance at a technical infringement is not, and no honest adviser will promise you otherwise.

Where and how the claim is brought

A data protection action under section 117 is brought in the Circuit Court or the High Court. Given the level of awards in ordinary cases, the Circuit Court is the usual venue. The action can seek compensation, and the court can also grant other relief including injunctions — for example restraining further processing.

Costs follow the ordinary litigation rules, which makes proportionality a live issue: the strategy for a modest claim must be run with costs discipline, and settlement engagement is often the sensible path. We advise on this candidly at the outset. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.

Claim, complaint, or both

A court claim and a DPC complaint are different instruments. The DPC investigates and can correct and sanction the organisation, but it cannot award you compensation. The court can award compensation, but does not regulate the organisation's wider conduct. They can be pursued in parallel, and a DPC outcome finding infringement can support a later claim — though it is not a precondition to suing.

Which route fits depends on what you want: vindication and systemic correction point to the DPC; genuine loss and damage point to a claim; serious cases often justify both.

Common claim scenarios

The patterns we see most:

Wrongful disclosure — your file, medical details or finances sent or shown to the wrong person
Data breaches at organisations holding your data, followed by phishing or fraud attempts against you
CCTV and recordings used beyond any legitimate purpose, including in workplaces
Ex-partners, neighbours or colleagues accessing records without authorisation, particularly in bodies holding sensitive files
Persistent refusal to honour access or erasure rights where damage flows from the refusal

Time and practicalities

Do not sit on a claim: limitation rules apply to data protection actions and the safest course is early advice — memories, footage and logs also degrade quickly, and preservation letters sent early can secure evidence that would otherwise be overwritten. Bring the paper trail to the first consultation: the breach notification if you received one, your correspondence, and a plain account of what the episode actually did to you. We will give you a straight assessment of merits, venue and realistic value before any proceedings issue.

Frequently asked questions

Can I claim compensation for distress alone, without financial loss?

Yes — non-material damage including distress and anxiety is compensable, and no minimum threshold of seriousness applies. But the distress must be real and proved; a bare infringement without demonstrated harm does not attract damages.

How much are data breach claims worth in Ireland?

Irish court guidance is that awards for ordinary non-material damage cases are modest — the leading Circuit Court authority awarded a sum in the low thousands. Cases involving financial loss, sensitive data or serious consequences are assessed on their facts. Be wary of anyone promising figures.

Do I have to complain to the DPC before suing?

No. A DPC complaint is not a precondition to a data protection action. The two routes do different things — only the court can award compensation, and only the DPC can regulate the organisation's wider conduct.

The company offered me credit monitoring after a breach. Does accepting affect my rights?

Accepting a support service does not in itself waive your rights, but anything you are asked to sign might. Read settlement or release wording carefully before signing, and take advice if compensation language appears.

Is there a deadline for bringing a claim?

Limitation periods apply to data protection actions, and arguments about the applicable period make delay risky. The practical rule: take advice promptly after the breach comes to your attention.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.