Last Updated 13th January 2026. A breach of criminal offence data is when personal information relating to alleged or convicted criminal activity is disclosed or accessed without authorisation, or lost, altered or destroyed, whether accidentally or intentionally. Such exposure amounts to a personal data breach. The UK GDPR and Data Protection Act 2018 mandate additional protections for data relating to criminal offences and organisations that fail to protect such personal information could owe those affected thousands in compensation for both the psychological distress caused and financial losses incurred.
Failure to protect personal data by not complying with these laws means that they could be investigated and fined by an independent body that upholds data protection rights for the public called the Information Commissioner’s Office (ICO). It also means you could sue them for compensation if the personal data breach harmed you.
A data controller is an organisation that will set the purpose for processing your personal data. Data controllers that could process your criminal offence data include the courts, police, solicitors, barristers or even your employer. Under data protection laws, these entities must ensure they keep this data secure so as not to comprise its integrity.
Speak to our team about starting a claim:
- You can call us on 0161 509 2856
- Contact us and request a callback
- Or use the live support option in the bottom right screen
You can also click on the highlighted text throughout this guide for additional help and information.
Chat With Us Today
Select A Section
- Could I Be Eligible To Make A Claim For A Breach Of Criminal Offence Data?
- What Counts As Criminal Offence Data Under UK Law?
- What Is A Breach Of Criminal Offence Data?
- Is Criminal Offence Data A Kind Of Special Category Data?
- Conditions For Processing Criminal Offence Data
- How To Claim For A Breach Of Criminal Offence Data
- What Could You Claim For A Breach Of Criminal Offence Data?
- No Win No Fee Claims For A Breach Of Criminal Offence Data
Could I Be Eligible To Make A Claim For A Breach Of Criminal Offence Data?
Yes you could be eligible to make a claim for a breach of criminal offence data if you can demonstrate that the data controller engaged in some wrongful conduct contrary to data protection law that resulted in your personal information being breached.
The general eligibility requirements are:
- The data controller failed to implement adequate measures to protect the personal data they stored.
- These failures resulted in a personal data breach, in which your personal information was affected.
- The breach of your personal data caused you psychological distress, financial harm or both.
To get a free eligibility assessment or to ask any questions you might have, speak to our advisors today via the contact information provided below.
What Counts As Criminal Offence Data Under UK Law?
Criminal offence data under UK law includes any information relating to specific convictions and court proceedings but also more generally, this category covers alleged offences and suspicions of such offences. This means information from police investigations and as well data held by solicitors.
This is therefore quite a broad category of personal data with examples including:
- Any records of arrests, cautions, charges or convictions of crimes.
- Data that relates to allegations of wrongdoing and investigations, even if no charges were made.
- Details of court proceedings, probation and sentencing.
- Police intelligence data.
- Employer records such as background checks or records referencing criminal, or suspected criminal conduct.
Such information, if released, could have dramatic effects on the daily lives of the data subjects, impacting their rights to a fair trial, to private and family life and the freedom to work or start a business. The societal stigma of those who are suspected or have been convicted of crimes means such information requires additional levels of protection.
What Is A Breach Of Criminal Offence Data?
Firstly, it’s helpful to understand that protected personal data is any information that can be used in isolation or alongside other details to positively identify you as a living person. With this in mind, it can be contact details. Or data relating to your health, beliefs or personal criminal offence data. A personal data breach is defined as:
- Sharing personal data with an unauthorised party
- A party sending your personal information to the wrong person or parties
- A data controller or processor losing files that contain data
- Or devices being stolen that have stored personal data on them
- Alteration of personal data in a security incident
- Personal data is compromised through unauthorised disclosure or access.
It can be possible to have an eligible breach of criminal offence data compensation claim if a data controller or processor has failed to adhere to data protection laws, and this has meant this data has been breached. You would be able to pursue compensation for the harm this has caused.
The 7 Core Principles
In order to help organisations avoid potential security incidents and data breaches, the UK GDPR have identified 7 core principles for ideal data processing. They state that data must be:
- Collected in a lawful and transparent way
- With an explicit purpose
- Kept to a minimum
- Retained in an accurate state
- Stored for limited periods (then destroyed in a secure way)
- Kept secure at all times
- Handled with personal accountability by all involved in the data use
As well as complying with these principles, organisations must meet at least one of 6 lawful bases for data processing.
Is Criminal Offence Data A Kind Of Special Category Data?
UK GDPR classifies some personal data as ‘special category data’, and this reflects the potential that data has to cause greater harm to the data subject if breached. Some special category data are health information, ethnic origin, sexual orientation and political or religious beliefs.
Personal data concerning convictions, criminal allegations or details relating to legal proceedings are not classified as a special category. However, there are very similar obligations when it comes to the processing of criminal offence data.
Conditions For Processing Criminal Offence Data
In the context of personal data in relation to allegations, criminal activity, and ongoing or past investigations, the controller must complete a data protection impact assessment (DPIA) if the processing is high risk.
Recital 75 of the Data Protection Act 2018 states that criminal offence data merits enhanced protection because of the potential risk it could pose to the fundamental rights and freedoms of the data subject. The stigma attached to those accused or convicted of crimes means that details leaked about them can fundamentally compromise their rights, liberty and security, the right to a fair trial, family life and freedom to conduct business.
Criminal offence data can only be processed if one of these conditions is met;
- Satisfies a condition in Schedule 1 of the DPA 2018.
- Under the control of official authority.
How To Claim For A Breach Of Criminal Offence Data
Not all instances of a breach of criminal offence data will mean those affected can make a personal data breach claim. If all has been done to protect the data, but still a breach occurs, then a claim is less likely.
To have a valid criminal offence data breach claim, you must be able to determine that the controller or processor failed in its obligation to comply with data protection laws; this caused your criminal offence data to be breached, and you suffered harm as a consequence.
Following a breach of your criminal offence data, you could take the following steps;
- Contact the party you think is responsible for breaching your data. They should respond to your enquiry. If they fail to do so or you are not satisfied, you can escalate your complaint.
- Complain to the ICO if your complaint is not taken seriously.
- The ICO cannot award compensation, but they can open an investigation
- Start to collect proof of the negative impacts of the data breach on your finances, health or reputation
- Change passwords and other security options on your devices
- Start to consider legal help.
What Could You Claim For A Breach Of Criminal Offence Data?
You could claim for both the mental health injury caused as well as related financial losses for a breach of criminal offence data. These are referred to as non-material and material damage, respectively. These two types of damage can be claimed independently as well as together so regardless of how you were affected, you can be compensated for the impact of the personal data breach.
Non-material damage can range broadly from general stress to serious post-traumatic stress disorder so getting a formal diagnosis is a very important part of the claims process. Compensation for non-material damage can be determined by using your medical evidence alongside the Judicial College Guidelines (JCG). Relevant JCG brackets have been used in the table here, apart from the top entry.
Compensation Table
Please be aware that this information is intended to act as guidance only.
| Type of Harm | Guideline Payout Figure | Further Notes |
|---|---|---|
| Very Serious Psychological Injury with Financial Losses | Up to £500,000+ | Where very serious psychological trauma has been sustained alongside significant material damage including lost pay, medical bills and security installations. |
| General Psychological Distress - Severe (a) | £66,920 to £141,240 | Marked issues in all areas of life and a poor future prognosis |
| Moderately Severe (b) | £23,270 - £66,920 | Long-standing mental health disability with a better prognosis than above |
| Moderate (c) | £7,150 to £23,270 | Although there were issues like those above, a marked improvement is seen by the time the case may come to trial |
| Less Severe (d) | £1,880 to £7,150 | These awards acknowledge the length of illness and the creation of any specific anxiety disorders like phobias |
| PTSD - Severe (a) | £73,050 to £122,850 | An acute and permanent injury that has detrimental impacts in all areas of the person's life |
| Moderately Severe (b) | £28,250 to £73,050 | Similar severities that see an improvement after professional intervention and counselling |
| Moderate (c) | £9,980 to £28,250 | More or less a recovery with persisting issues not being grossly disabling |
| Less Severe (d) | £4,820 to £9,980 | A recovery within one or two years with only minor symptoms continuing after this period. |
Material Damage In Breach Of Criminal Offence Data Claims
Material damage in breach of criminal offence data claims refers to any financial harm you sustain as a result of the exposure of your personal information. Examples of these losses which you could be compensated for include:
- A loss of earnings from any time taken off work due to emotional distress.
- Medical expenses such as medication or counselling services.
- The cost of security installations in your home (cameras, alarms, additional locks) or even a full relocation if your address has been compromised and your safety is at risk.
Supporting documentation such as payslips, purchase receipts and bills for counselling will need to be provided as proof of any losses. To find out about claiming data breach compensation in your particular circumstances, get in touch with our advisors today.
Chat With Us Today
No Win No Fee Claims For A Breach Of Criminal Offence Data
You can start a data breach claim independently or with the help of a data breach solicitor. But if you are worried about costs, a solicitor can represent you under a No Win No Fee agreement. This means you often only need to pay a maximum 25% deduction from any settlement awarded when the case wins under a Conditional Fee Agreement. There are no fees to pay your solicitors if the case fails.
Our team can connect you with a data breach No Win No Fee solicitor to take up your case today.
There is a 6-year time limit to data breach compensation claims. This reduces to 1 year in cases against a public body. So please don’t delay. Get in touch by:
- You can call us on 0161 509 2856
- Contact us and request a callback
- Or use the live support option.
Read More
More guidance on different types of personal data breach claims can be found here:
- Find out if you could make a landlord data breach claim today with our expert solicitors.
- If social services sent personal details to an ex-partner, considerable distress could be caused to both you and any children. Check if you could seek compensation today.
- How to make a sexual abuse data breach claim
- Check if you could be eligible to make a lost records data breach claim using this guide.
For more advice, you can check out the external resources below:
- As well as this, please see statistics on the subject
- Also, more reading on the Data Protection Act 2018
- And in conclusion, tips on how you can stay safer online
