They said this… · Data protection & SARs

“The ICO can award you compensation for a data-protection breach”

Generally incorrect

The ICO can investigate/regulate compliance but does not ordinarily award damages to an individual complainant.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • Compensation may be sought through settlement or court proceedings where the legal test is met.
  • An ICO outcome can still be relevant evidence.
  • Do not confuse regulatory action with individual damages.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.