Data Breaches, Compensation and Evidence: What Should a Business Keep?

A security incident can create operational, regulatory and legal questions at the same time. Businesses need to establish what happened, whether personal data was involved, what risk people face and what action is required. A headline about a court case may be relevant context, but it is not a substitute for assessing the facts of an organisation's own incident.

What is Farley v Paymaster about?

Michael Farley and 431 others v Paymaster (1836) Limited, trading as Equiniti (UKSC/2025/0185), is a case before the UK Supreme Court. It concerns pension statements sent to outdated addresses and asks whether a threshold of seriousness applies to claims for damages under the UK GDPR and Data Protection Act 2018. The Supreme Court's case page, last updated 10 October 2026, recorded the matter as awaiting judgment after the hearing on 7–8 October. That is a procedural status, not a result; this article does not predict the decision.

The case is specifically about damages claims and the legal question before the court. It does not mean every data-handling error automatically results in compensation, nor does it determine the outcome of every future claim. Check the official case page for an updated status, and read the report that prompted this article.

An incident and a personal data breach are not identical

A malware alert, lost laptop or unavailable service is a security incident that needs triage. Under the UK GDPR, a personal data breach involves a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. One incident may involve personal data; another may not. The organisation must establish what happened rather than decide from the incident label alone.

The ICO says organisations must report a notifiable personal data breach without undue delay and, where feasible, within 72 hours of becoming aware. Where a breach is likely to result in a high risk to individuals, they must also be informed without undue delay. Organisations should keep a record of personal data breaches, including those that do not meet the notification threshold. The ICO's personal data breach guide explains the assessment and reporting duties.

Security is a continuing responsibility

UK data protection law expects appropriate technical and organisational measures, taking account of the circumstances and risks. No single control guarantees that an incident will not occur. Instead, a business should be able to explain why its measures were proportionate, who owned them and whether they were operating.

Useful evidence may include dated access reviews, MFA coverage, patch status for supported systems, endpoint alerts, backup job results and restore-test records, supplier access approvals, security incident logs and staff escalation procedures. Evidence should show what was done and any known exceptions. A policy that says MFA is required is not the same as a report showing which accounts have MFA enabled.

Keep records accurate and limited to what is necessary. A log may contain personal data, so access, retention and disclosure should be controlled. Do not gather or retain more data simply because it might be useful in a hypothetical claim.

Prepare a response before the clock starts

Assign an incident lead and a route for staff to report suspected exposure. Preserve relevant logs and identify which systems, accounts, suppliers and datasets may be involved. Contain ongoing access in a way that protects evidence and business operations. Involve the privacy lead or data protection officer where applicable, and seek legal or specialist advice when the facts or risk require it.

Assess the likelihood and severity of harm to people, what data was affected, who could access it, whether it was encrypted and what containment has worked. Record the decision, reasons, actions and review time. If information is incomplete, update the assessment as evidence develops; do not wait for a perfect forensic report before considering a statutory deadline.

Afterwards, check whether the cause was a one-off mistake, an access weakness, a supplier issue or a control that existed on paper but failed in practice. Fix the underlying issue, test the change and record the result. This supports operational learning as well as regulatory accountability.

Practical questions for a small business

• Can staff report a suspected data incident to a named person at any time?
• Can you identify who has access to sensitive systems, including suppliers and former staff?
• Can you retrieve relevant logs and determine whether data was accessed or disclosed?
• Have backups been restored in a test, and are the results recorded?
• Can you document why a breach was or was not reported, and who approved that decision?

Compensation is a legal question based on the applicable facts and law. An incident alone does not establish liability or an automatic payment. Technology controls and contemporaneous records can help an organisation understand and explain its response; they do not replace legal advice or guarantee a particular outcome. See the Data Protection Act 2018, section 168 for the statutory provision about compensation under Article 82.

Sources and further reading

• UK Supreme Court: Farley v Paymaster (UKSC/2025/0185)
• ICO: Personal data breaches guide
• Data Protection Act 2018, section 168

This article is general information, not legal advice. Organisations should assess their own circumstances and take advice where appropriate.