Data Protection Act 1984

23 Compensation for loss or unauthorised disclosure

(1) An individual who is the subject of personal data held by a data user or in respect of which services are provided by a person carrying on a computer bureau and who suffers damage by reason of—

(a) the loss of the data ;

(b) the destruction of the data without the authority of the data user or, as the case may be, of the person carrying on the bureau; or

(c) subject to subsection (2) below, the disclosure of the data, or access having been obtained to the data, without such authority as aforesaid,

shall be entitled to compensation from the data user or, as the case may be, the person carrying on the bureau for that damage and for any distress which the individual has suffered by reason of the loss, destruction, disclosure or access.

(2) In the case of a registered data user, subsection (1)(c) above does not apply to disclosure to, or access by, any person falling within a description specified pursuant to section 4(3)(d) above in an entry in the register relating to that data user.

(3) In proceedings brought against any person by virtue of this section it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to prevent the loss, destruction, disclosure or access in question.