Data Breach Complaint Letter Template & Generator

If you need to complain about a data breach and request information and remedy, a written letter is the recommended first step — it creates a clear record and shows you're pursuing the matter formally. Below is what a strong data breach complaint letter should include, plus a free tool to generate yours.

What this letter needs to cover

• Describe what data was involved and how the breach occurred
• Request full details of the breach, what data was affected and what steps the organisation is taking
• Reference their obligation to report to ICO within 72 hours
• Request confirmation of steps taken to prevent recurrence
• Reserve right to claim compensation

Your rights after a data breach

If an organisation has experienced a data breach involving your personal information, you're entitled to be told what happened, what data was affected, and what they're doing about it — this is a requirement under UK GDPR, not something organisations can simply decline to explain. Where a breach poses a genuine risk to you, they're also required to notify you directly, not just the Information Commissioner's Office.

What to include before you send it

• Reference to the breach, including how and when you became aware of it
• A request for full details — what data was involved, how the breach occurred, and what risk it poses to you
• What remedial steps you expect — this could include credit monitoring, an apology, or compensation if you've suffered genuine harm or distress
• A request for confirmation of what's being done to prevent a recurrence

When compensation may be appropriate

You may be entitled to compensation for a data breach if you've suffered genuine financial loss or significant distress as a result — this isn't automatic for every breach, but a serious breach involving sensitive information causing real anxiety or harm can support a claim, either directly against the organisation or, if unresolved, through the courts.

Frequently Asked Questions

Should I also report this to the ICO?
You can report a data breach to the Information Commissioner's Office if you're not satisfied with the organisation's response, particularly if they've failed to properly investigate or respond.

How long does an organisation have to respond to a breach complaint?
There's no fixed statutory deadline for responding to your complaint specifically, though you're entitled to a response within a reasonable timeframe, and can escalate to the ICO if there's unreasonable delay.

See our full letter template & generator library for related letters, or use our free checkers for guidance specific to your situation.