Data Protection Act 2018, section 168

Compensation for contravention of the UK GDPR

PART 6 Enforcement

(1) In Article 82 of the [F717 UK GDPR F717] (right to compensation for material or non-material damage), “non-material damage” includes distress.

(2)Subsection (3) applies where—

(a)in accordance with rules of court, proceedings under Article 82 of the [F718UK GDPRF718] are brought by a representative body on behalf of a person, and

(b)a court orders the payment of compensation.

(3)The court may make an order providing for the compensation to be paid on behalf of the person to—

(a)the representative body, or

(b)such other person as the court thinks fit.

Definitions used in section 168 1

representative body

(5) In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the UK GDPR or this section.

Defined in s.187(5) · see it in the full Act

Cases considering section 168 8

Michael Farley & Anor v Paymaster (1836) Limited (trading as Equiniti)

[2025] EWCA Civ 1117 · 22 August 2025Interprets

The provision makes clear that non-material damage includes distress. It does not define or limit Article 82, so compensation is not confined to a pleaded label of distress (see paras [41]; [49]-[53]).

Joseph Pacini & Anor v Dow Jones & Company Incorporated

[2024] EWHC 1709 (KB) · 3 July 2024Interprets

The provision formed part of the pleaded compensation claim, including alleged reputational damage, anxiety and distress. The court treated the recoverability of reputational damages in data-protection proceedings as unsettled and unsuitable for summary determination (see paras [43]; [92]-[107]).

President Donald J Trump v Orbis Business Intelligence Limited

[2024] EWHC 173 (KB) · 1 February 2024

Confirms that distress is included within non-material damage for the purposes of Article 82 of the UK GDPR. The court nevertheless held that the claimant had not pleaded or shown distress caused by the surviving post-2018 storage. (see paras [101]-[105], [116]-[129])

What each judgment says about section 168 is in the case-law panel in the full Act.

Amendments and notes

4 notes from legislation.gov.uk

Amendments

  1. F716Words in s. 168 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 69(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F717Words in s. 168(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 69(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F718Words in s. 168(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 69(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I175S. 168 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)