PSNI compensation cost reflects risks of data breaches

The breach came after a PSNI response to a freedom of information request shared names of all police and civilian staff, locations and jobs, which were published online before being removed. The details of more than 9,000 employees of the Police Service of Northern Ireland were exposed, which the country’s Police Federation warned could cause “incalculable damage" to the safety of officers.

Now police and civilian staff with PSNI have been offered a £7,500 payment to compensate those affected by the breach.

The Northern Ireland administration ringfenced £119 million to cover the damages last year, with group actions being brought against the police by some of those impacted by the breach.

Laura Gillespie, a data breach expert with Pinsent Masons, said the development offered some limited assistance to controllers trying to benchmark the assessment of damages to the victims of data breach cases, especially where there are more serious implications.

“With the rise of mass actions, many controllers who face a data breach want to understand what value claims might attract if persons notified of a data breach pursue damages,” she said.

“It might be said that the sensitivity of the data in the PSNI is atypical, given the potential security risk to personnel which persists in Northern Ireland. 

“There remains limited case law in the UK evaluating damages where individuals have been identified as being a “high risk” as identified in UK GDPR, but the risk relates to financial and biographical information rather than information which could potentially pose a personal security risk.

“With £119m set aside to settle the PSNI claims however, this demonstrates the high cumulative cost which can follow a data breach.”

This development follows in the wake of an offer being made in Ireland by the Health Service Executive which suffered a ransomware attack in May 2021. In December 2025, it was reported that an offer of €750 compensation was being made to the victims with an additional €650 being offered for legal costs.

Lisa Carty, a commercial litigation expert with Pinsent Masons, explained: “The offer from the HSE came shortly after an Irish Supreme Court judgment in which it was noted that claimants seeking non-material damages for injuries suffered from a data breach, which are not personal injuries, cannot expect anything other than ‘very, very modest awards’. 

“These types of claims can be distinguished from the PSNI claims but it does give some assistance in understanding the likely level of damages in non-material damage claims.”

Assessment of damages in data breach cases continues to evolve quickly, with further clarity expected from the UK Supreme Court in a case concerning a dispute where, last year, current or former police officers with Sussex Police impacted by a data breach successfully appealed against a decision striking out most of their compensation claims.