Responding to a GDPR compensation claim—a practical guide
Produced in partnership with Robert Brodrick and Stephen Woodward of Payne Hicks Beach
Responding to a GDPR compensation claim—a practical guide

The following Dispute Resolution guidance note Produced in partnership with Robert Brodrick and Stephen Woodward of Payne Hicks Beach provides comprehensive and up to date legal information covering:

  • Responding to a GDPR compensation claim—a practical guide
  • Does the claim fall within the scope of the GDPR?
  • Defending GDPR compensation claims—identity of the defendant—controllers and processors
  • Defending GDPR compensation claims—assessing the merits—is there a claim?
  • Defending GDPR compensation claims—available exemptions
  • Defending GDPR compensation claims—threat of group litigation and representative action
  • Defending GDPR compensation claims—contribution claims
  • Defending GDPR compensation claims—jurisdiction
  • Defending GDPR compensation claims—initial procedural considerations
  • Defending GDPR compensation claims—refining data processes
  • more

This Practice Note considers how to respond to a compensation claim under the General Data Protection Regulation, Regulation (EU) 2016/679, (GDPR) and the Data Protection Act 2018 (DPA 2018) which implements provisions related to and permitted derogations from the GDPR into UK law. It is not intended to be a comprehensive guide to defending civil claims or procedural issues for defendants and, instead, focuses on the key factors that will often arise specifically in the context of compensation claims that arise out of the misuse of personal data rights.

Currently, there is no case law specifically addressing GDPR compensation claims and so it remains to be seen how many of the regulations will be applied in the UK courts. In some instances, it is illustrative to refer to case law arising from the Data Protection Act 1998 (DPA 1998).

This Practice Note covers:

  1. the identity of the defendant

  2. assessing the merits of the claim

  3. relevant defences and exemptions

  4. the extent of liability—threats to defendants (representative actions and contribution claims)

  5. initial procedural considerations (including pre-action and jurisdictional matters)

  6. alternative dispute resolution and attempts to settle a GDPR claim

There are a number of considerations that a defendant to a GDPR compensation claim will need to consider, some of which will be specific to the data protection regime in the UK, others applicable more generally to