Legal Action

Legal action is an impact of a security breach where an organisation can be punished for failing to protect customer data or for breaking data protection law, such as the Data Protection Act or GDPR. It is not just a warning: it can lead to the organisation being fined, taken to court or sued. Legal action does not have to involve the police or a criminal case; it usually means a regulator or a customer taking action against the organisation.

The Information Commissioner's Office (ICO) is the UK regulator for data protection. It can investigate an organisation and, if it finds the law has been broken, issue a fine and take the organisation to court. It can also serve an enforcement notice ordering the organisation to change how it handles data, for example by improving security or deleting data it should not hold. Individuals whose data was affected can sue the organisation, asking for compensation for the harm or distress the breach caused.

Why it matters

Legal action is a serious impact because it combines money lost through fines and compensation with damage to the organisation's reputation. It also forces staff to spend time dealing with lawyers, investigations and legal requirements instead of normal work.

For example, a holiday club that runs activity days for children holds medical details and emergency contacts. After a breach exposes these records, the ICO finds the club did not protect the data properly. It fines the club and orders it to change its security, and some parents sue for distress and receive compensation.