Data Breach Complaint Letter: Free Template and What to Include

If you need to complain about a data breach and request information and remedy, a written letter is the recommended first step — it creates a clear record and shows you're pursuing the matter formally. Below is what a strong data breach complaint letter should include.

What this letter needs to cover

• Describe what data was involved and how the breach occurred
• Request full details of the breach, what data was affected and what steps the organisation is taking
• Reference their obligation to report to ICO within 72 hours
• Request confirmation of steps taken to prevent recurrence
• Reserve right to claim compensation

Your rights after a data breach

If an organisation has experienced a data breach involving your personal information, the organisation must tell you directly and without undue delay if the breach is likely to result in a high risk to you (UK GDPR Article 34). You can also ask what happened, what data was affected and what it is doing about it, and you can make a subject access request for your own information.

What to include before you send it

• Reference to the breach, including how and when you became aware of it
• A request for full details — what data was involved, how the breach occurred, and what risk it poses to you
• What remedial steps you expect — this could include credit monitoring, an apology, or compensation if you've suffered genuine harm or distress
• A request for confirmation of what's being done to prevent a recurrence

When compensation may be appropriate

You may be entitled to compensation for a data breach if you've suffered genuine financial loss or significant distress as a result — this isn't automatic for every breach, but a serious breach involving sensitive information causing real anxiety or harm can support a claim, either directly against the organisation or, if unresolved, through the courts.

Frequently Asked Questions

Should I also report this to the ICO?
You can report a data breach to the Information Commissioner's Office if you're not satisfied with the organisation's response, particularly if they've failed to properly investigate or respond.

How long does an organisation have to respond to a breach complaint?
From 19 June 2026 every organisation must give you a way to make a data protection complaint to it, acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome. If it does not, you can complain to the ICO.

[Your Name]
[Your Address]
[Your Postcode]
[Your Email Address]
[Your Phone Number]
[Name of Organisation]
[Address Line 1]
[Address Line 2]
[Postcode]
[Date]

Dear [Name of Contact or "Data Protection Officer"],

Subject: Formal Complaint about a Personal Data Breach

I am writing to make a formal complaint about a breach of my personal data. I understand that a data breach happened on or around [Date of breach] and involved my personal information. I found out about it on [date] when [e.g. you emailed me / I read about it in the news].

I understand the breach exposed my [types of data, e.g. name, home address and email address].

This breach has caused me distress and concern about the security of my personal information. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, your organisation has a legal duty to protect my data using appropriate technical and organisational measures.

Please give me a full response within 30 days setting out:
• How the breach happened and exactly what data of mine was involved
• What you have done to reduce the risks to my data
• What you are doing to make sure this does not happen again
• Your reference number for this incident, and whether you reported it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it

I reserve my right to claim compensation. If I am not satisfied with your response, I intend to complain to the Information Commissioner's Office.

Yours sincerely,

[Your Signature]
[Your Printed Name]