Skip to content
Emergency

Data breach: your rights as an affected person

If personal data is accessed impermissibly or lost at a company, there is a data breach. Affected persons then have special rights, from notification to damages.

Reach your next steps and the matching ready-made texts in just a few minutes, free of charge:

Create a letter →

Your chances of getting your money back

In a data protection breach with a high risk, the controller must notify the affected persons (Art. 34 DSGVO) and report the breach to the supervisory authority. You have information rights about the extent and consequences.
Anyone who suffers material or immaterial damage through a data breach can demand damages (Art. 82 DSGVO). Even a loss of control over the data can, according to case law, establish damage.

What you should do now

  1. 1

    1. Demand information

    Demand information from the company on which data is affected and what consequences threaten.

  2. 2

    2. Secure accounts

    Change affected passwords and monitor accounts and debits.

  3. 3

    3. Use the supervisory authority

    In case of violations you can turn to the data protection supervisory authority.

  4. 4

    4. Assert damage

    With concrete damage or a loss of control you can demand damages.

How to spot the scam

  • The company does not inform about the breach despite a high risk.
  • After a data leak, phishing attempts or fraud accumulate.
  • Access data or payment data is affected.

Frequently asked questions

Must a company inform me about a data breach?

In a data protection breach that likely means a high risk to your rights, the controller must notify you without delay (Art. 34 DSGVO) and report the breach to the supervisory authority. You can also demand information about the affected data.

Do I have a claim to damages?

Anyone who suffers material or immaterial damage through a violation of the DSGVO can demand damages (Art. 82 DSGVO). According to case law, even a mere loss of control over the data or well-founded concern about misuse can be enough. The amount depends on the individual case.

What should I do after a data leak?

Change affected passwords, activate two-factor login where possible, monitor accounts and debits and be especially watchful toward phishing. Document the breach and any consequences so you can support claims.

Take action now

We put together the ready-made texts and the right places to contact for you.

Create a letterCheck a suspicious message
More help: Emergency by phone · Act together · Right to a lawyer · All guides

General information for self-help, not legal advice (RDG). In case of a high loss or uncertainty: contact a consumer advice center or a lawyer.