Data protection and privacy are related but distinct
The UK GDPR and Data Protection Act 2018 regulate the processing of personal data. Privacy claims may also involve misuse of private information, confidentiality, harassment, defamation or Article 8 interests depending on the defendant and facts. The correct route therefore starts with the material, who holds it, what happened to it and what outcome is needed.
Start by preserving the disclosure.
Save the email, post, web page, screenshot, metadata, recipient list and correspondence. If information was published online, record the URL, date and context before the material changes.
Common problems we can assess
Inaccurate personal data
Where a business, organisation or other controller records or circulates information that is materially inaccurate and causes continuing prejudice.
Wrongful disclosure
Emails sent to the wrong recipient, exposed records, unauthorised publication or other disclosures may engage data protection, confidentiality or privacy rights.
Erasure and rectification
Requests to correct or erase data depend on the legal basis for processing, statutory exemptions and whether retention remains necessary or lawful.
Private information published online
The response may involve the publisher, platform, search engine or a court application, depending on the information and urgency.
Rectification and erasure requests
The right to rectification and the right to erasure are not absolute. A controller may have a lawful reason to retain information, and exemptions can apply. A strong request identifies the precise data, why it is inaccurate or no longer lawfully required, the evidence supporting the correction and the practical harm caused by continued processing.
Data breaches and compensation
A security incident does not automatically create a valuable damages claim. The legal analysis considers the defendant's obligations, the nature of the breach, causation and evidence of material or non-material damage. Claims should be proportionate to the seriousness and actual impact of the incident.
Misuse of private information
Where information is genuinely private, the court may consider whether there was a reasonable expectation of privacy and then balance competing rights and interests. Publication disputes can be urgent, particularly where material has not yet been widely disseminated and interim relief is being considered.
ICO complaint or court proceedings?
A complaint to the Information Commissioner's Office and a civil claim are different routes. The ICO can investigate regulatory compliance but does not generally determine and award civil damages in the way a court can. In some cases a regulator complaint is useful; in others the priority is rectification, removal, an injunction or compensation. The route should match the objective.
Search engines and online removal
Removing material at source, obtaining search delisting and correcting underlying records are separate tasks. The strongest strategy often identifies all three layers rather than assuming one request will erase the information everywhere.
Frequently asked questions
Can I force a company to delete all information about me?
Not automatically. Erasure rights are subject to lawful-retention grounds and exemptions. The request must be assessed against the reason the data is being processed.
Can I claim compensation for a data breach?
Potentially, if the legal requirements are met and compensable damage can be established. The value depends on the nature, seriousness and consequences of the breach.
Can you stop private information being published?
In an appropriate urgent case, interim relief may be considered, but the threshold is demanding and the court will examine the competing legal rights and evidence carefully.
What should I send you?
Send the material complained of, the URL or recipient details, correspondence with the organisation, any privacy or data request already made and evidence showing the practical impact.