Data Breach and Privacy Violation: What You’re Actually Owed

There is no single comprehensive federal data-breach law in the US. Instead, all 50 states (plus DC and other territories) have their own breach-notification statutes, with different definitions of what counts as a breach and different notification deadlines. A growing number of states now use fixed day-counts rather than vague language: for example, California tightened its rule in 2025–2026 (SB 446) to a hard 30-calendar-day notification deadline from discovery, subject to law-enforcement delay; Florida also uses 30 days (with a possible 15-day extension for good cause); other states use 45 or 60 days. Many states still use qualitative language like "without unreasonable delay" instead of a fixed number. verify your specific state’s current deadline before relying on a number, since this changes often

The FTC can bring enforcement actions against companies for inadequate data security or broken privacy promises under its general Section 5 "unfair or deceptive practices" authority — this produces regulatory penalties and required changes to a company’s practices, not a personal payment to you. HIPAA (healthcare data) and the Gramm-Leach-Bliley Act (financial data) are sector-specific federal laws with no private right of action at all — your recourse for a HIPAA or GLBA breach is generally a regulatory complaint (to HHS Office for Civil Rights, within 180 days of discovery for HIPAA) or a separate state-law claim on the same facts, not a federal lawsuit under those statutes themselves.

California is a notable exception: the CCPA, as amended by the CPRA, gives consumers a limited private right of action specifically for breaches of nonencrypted, nonredacted personal information caused by a business’s failure to maintain reasonable security — allowing statutory damages of $100 to $750 per person per incident (or actual damages if higher), without needing to prove a specific dollar loss. The CPRA also eliminated the original 30-day pre-suit "cure" notice that used to let companies avoid liability by fixing the problem after the fact. Very few other state privacy laws include any comparable private right of action for a breach.

Under GDPR, controllers must notify the relevant supervisory authority "without undue delay and, where feasible, not later than 72 hours" after becoming aware of a breach (Article 33), unless the breach is unlikely to risk individuals’ rights and freedoms. Individuals themselves only need to be notified (Article 34) where the breach is likely to result in a high risk to their rights and freedoms — there’s no fixed deadline for that individual notice, only "without undue delay."

Article 82 gives a right to compensation for material or non-material damage caused by a GDPR infringement, but the CJEU’s 2023 ruling in UI v Österreichische Post (Case C-300/21) clarified that mere infringement of the GDPR does not automatically entitle you to compensation — you must show an infringement, actual damage (which can include non-material harm like distress), and a causal link between them. The court also held there’s no minimum "seriousness" threshold once actual damage is shown, but the GDPR itself sets no rules for quantifying damages — national courts apply their own domestic law, so awarded amounts vary significantly by member state.

In the UK post-Brexit, UK GDPR plus the Data Protection Act 2018 (section 168) carry over the same 72-hour supervisory-notification structure and a parallel Article 82-style compensation right, explicitly including distress as non-material damage. Complaints go to the Information Commissioner’s Office (ICO), which targets resolving 90% of cases within six months — but the ICO itself cannot award you compensation; it only pursues regulatory enforcement. A compensation claim under Article 82/section 168 must be brought separately in court, generally within the ordinary 6-year civil limitation period under the Limitation Act 1980. verify current ICO service standards and limitation rules before relying on them

Most people’s actual recovery comes from a class-action settlement or free credit monitoring, not an individual lawsuit — individual claims outside California’s CCPA statutory-damages provision are relatively rare and often not cost-effective without documented, significant harm.

Both US courts (in states without a specific statutory-damages provision) and EU/UK courts under Article 82 generally require you to show actual harm, not just that a breach occurred — a bare notification, without more, is unlikely to produce a payout on its own.

This page can help you understand your notification rights and possible claim routes, but it cannot predict a specific settlement amount or court outcome.