Data Breach Claim Time Limits: How Long Do You Have?
In most cases, you have six years to make a data breach compensation claim in England and Wales, under the Limitation Act 1980. However, there are some circumstances in which this time limit is stricter: for example, claims involving personal injury (including some psychiatric harm) often have a three-year limit. The limitation period can differ in Scotland and Northern Ireland.
The General Rule: 6 Years Under the Limitation Act 1980
You might have heard of a ‘statute of limitations,’ a phrase that’s commonly used in discussions of crimes like murders and bank robberies – but there’s actually a statute of limitations for all kinds of legal claims. The Limitation Act 1980 is the relevant legislation that imposes these limits in England and Wales. For most claims of this type, the time limit is six years.
Why this period applies to most data breach claims
Data breach claims can be brought under different legal causes of action, including data-protection legislation and, depending on the circumstances, misuse of private information or other causes of action. The applicable limitation period therefore depends on the particular claim being brought. Of course, the modern internet didn’t exist in 1980, but the Act outlines time limits for several types of claims. While legislators couldn’t have anticipated the damages inflicted upon an individual through the mishandling of their data, it’s the structure of the legal claim that determines its time limit.
When the clock actually starts ticking
This is a key nuance to understand, particularly if the claim you’re pursuing is close to passing the end of its limitation period. The limit for personal injury claims often hinges upon when the injury occurred or what’s called the claimant’s ‘date of knowledge’ – but this is not the case for data breach claims under the UK GDPR. Instead, the clock typically starts ticking when a breach caused you to suffer damage (whether material or non-material).
Sometimes, data breaches can go undetected for many years – and in some cases the organisations affected may fail to disclose them. The Information Commissioner’s Office (ICO) imposes certain obligations on organisations to report data breaches within 72 hours of becoming aware of it, and affected individuals must be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The kind of notifications that constitute reasonable awareness include email, post and more, so it’s always worth keeping an eye out for data breach notifications in your inbox.
Exceptions: When the time limit is shorter
Claims involving personal injury
A shorter limitation period may apply where the compensation sought includes damages for personal injury. Under section 11 of the Limitation Act 1980, an action for damages for negligence, nuisance or breach of duty is generally subject to a three-year limitation period where the damages claimed consist of, or include, damages for personal injury.
For these purposes, personal injury can include a medically recognised psychiatric condition. It does not ordinarily include distress, anxiety or upset which does not amount to a recognised psychiatric injury. A claim seeking compensation only for financial loss or distress under data protection legislation will therefore generally remain subject to the ordinary six-year period applicable to data protection claims.
Where section 11 applies, the three-year period generally runs from the later of:
- The date on which the cause of action accrued; or
- The claimant’s statutory “date of knowledge”
It’s also worth bearing in mind that, under Section 33, courts have discretion to disapply the three-year window if it is “equitable” to do so – this would, again, be determined on a claim-by-claim basis.
What happens if you miss the time limit?
If you start proceedings after the applicable time limit for a typical data breach claim, the defendant can raise limitation as a complete defence and the claim may be dismissed. Courts cannot generally extend the ordinary six-year period, although limited statutory exceptions may apply.
Why you shouldn’t wait until the deadline
Whenever you’re notified about a data breach, you should safeguard the evidence and plan your next steps. The longer you leave it, the more difficult it might be to retrieve the data breach notification, document any damage suffered, and enlist the appropriate legal support to bring a claim on your behalf.
Practically speaking, legal representatives may be reluctant to take up claims that are close to expiring, meaning the six-year time limit can be shorter in real terms.
How to check if you’re still in time to claim
You can check all of our currently live claims by clicking the button below. If you believe you could be affected by any of the listed data breaches, you can provide your details so that your potential eligibility can be assessed.
Frequently Asked Questions
How long do I have to make a data breach claim in the UK?
In most cases, you have six years from the relevant date to make a data breach claim in England and Wales, under the Limitation Act 1980. This period can be shorter in specific circumstances — for example, claims involving diagnosed psychiatric injury generally have a three-year limit, and the rules differ slightly in Scotland and Northern Ireland.
Does the six-year limit start from the breach date or when I found out?
For a typical data breach compensation claim, time runs from when the claim first became actionable, normally when the breach caused material or non-material damage, such as financial loss, and genuine distress and anxiety.
Can I claim for a data breach that happened years ago?
Potentially, yes — if you're still within the six-year limitation period, it may still be possible to claim compensation. This is particularly relevant if an organisation was slow to disclose a breach, since the time limit is generally tied to when you found out, not when it happened.
What happens if the time limit has already passed?
If the limitation period has expired, the defendant can raise this as a complete defence and the claim may be dismissed. Courts have no general discretion to extend the ordinary six-year period, although specific rules, such as those concerning deliberate concealment or legal disability, may affect the calculation.
Is the time limit different for group data breach claims?
The same general limitation rules typically apply whether you're claiming individually or as part of a group action — it's the type of claim (e.g. tort, personal injury) that determines the time limit, not whether you're claiming alone or alongside others. That said, it's worth checking the specifics of any group claim you're considering, as practical deadlines for joining can sometimes be set earlier than the legal limitation period itself.
