Personal data breach: am I affected, and what should I do?

Find out what was exposed, then protect what matters.

The answer in 2 lines. Verify a breach notice through the organisation's usual website or contact details. Ask whether your information was involved and exactly what was exposed. Replace compromised or reused passwords, protect your email account and contact your bank if financial information is at risk. Be wary of follow-up messages: knowing your real details does not prove that a caller is genuine. You can complain to the organisation and then seek help from the data protection regulator.

What to do first

Check the notice independently. Open the service through your usual route rather than following the message's links or calling a number it supplies.
Ask what happened, which of your details were affected, what the organisation is doing and what action it recommends for your case.
Replace an exposed password wherever you reused it. Give your email account a unique password and enable extra sign-in protection where available.
Save the notice and keep a record of suspicious activity, correspondence, expenses and any resulting loss.

Stop: danger

An unexpected caller offers to secure your account: end the call. Do not disclose passwords or approval codes, approve a payment or move money on their instructions. Contact the organisation independently.

How to establish whether you are affected

A report that an organisation suffered a breach does not establish that every customer's information was exposed. Ask for confirmation about your own records. A breach can involve lost paperwork, an email sent to the wrong person or unauthorised access, as well as a cyberattack.

The Information Commissioner's Office explanation helps you understand what counts as a breach. Use it to frame questions about access, disclosure and the information affected. Avoid entering personal details into an unfamiliar checking website promoted by an unsolicited message.

Match the action to the exposed information

Passwords: replace exposed credentials and reused versions. Check account recovery settings and unfamiliar sign-ins.
Email addresses and phone numbers: expect convincing phishing attempts. Verify requests through a separate, trusted route.
Card details: contact your bank promptly and ask whether the card needs blocking or replacing.
Account number and sort code: monitor transactions and report unfamiliar activity. These details being exposed does not automatically mean someone can sign in to your banking.
Identity documents or sensitive records: ask the organisation for specific protective advice and watch for unfamiliar accounts, demands or correspondence.

Use the NCSC data breach guide to work through the protective actions relevant to the information involved.

What not to do

Changing every account at random while leaving a compromised email password unchanged.
Trusting a caller because they know your address, date of birth or account information.
Uploading identity documents through a link in an unverified breach notice.
Paying someone who guarantees that every copy of leaked information can be erased.

Watch for scams using accurate details

A caller may quote real information and claim a refund or security check is urgent. That information may have come from a breach or public sources. Follow Ofcom's advice: stop, check independently and report suspicious contact. Use a number from a statement or the organisation's genuine website.

For suspicious messages, the GOV.UK reporting page explains how to forward emails and texts. If money has gone or an account has been taken over, contact the bank or service immediately as well.

Your rights and complaints in England

Under the UK data protection framework, organisations generally must inform affected people without undue delay when a breach is likely to create a high risk to their rights and freedoms. Not every breach requires individual notification. The official breach guidance explains the threshold.

Write to the organisation's privacy or complaints contact first. The ICO's affected-person guide explains what to ask and links to complaint guidance. Follow that route if you remain dissatisfied, keeping the original notice and your correspondence. The data protection framework is UK-wide; fraud reporting and court procedures can differ elsewhere in the UK.

Good to know

A breach notification is not proof that identity theft or financial fraud has already happened.
No notification does not necessarily mean your information was unaffected: ask the organisation if you have a specific concern.
Keep records of actual effects rather than relying on a promised compensation amount.

Illustrative example: A leisure centre tells Aisha that membership contact details were exposed. She verifies the notice through its usual website and asks whether passwords were involved. Later, a caller knows her name and offers a refund. She ends the call and checks independently rather than sharing a banking approval code.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on 6 November 2026, for England. Confidence: high for protective actions, notification principles and complaint routes; medium for an individual's exposure and remedies, which depend on the breach and supporting evidence.