The UK GDPR establishes a robust framework for the protection of personal data, requiring organisations to give due regard to individuals’ data protection rights. Importantly, it recognises that the consequences of a data breach may extend beyond financial loss. Article 82 UK GDPR, supplemented by section 168 of the Data Protection Act 2018, provides a right to compensation for both material and non-material damage, including harm such as distress, anxiety and reputational damage. The threshold for proving damage arising from any breach of the UK GDPR has, to date, received greater judicial analysis in England than in Scotland.
Two recent Scottish decisions, the latter published last week, provide reassurance for controllers by reaffirming that, consistent with Lloyd v Google, a mere data protection infringement does not entitle a claimant to compensation.
In Prentice v Chief Constable of Police Scotland [2025] SC LAN 32, the sheriff dismissed a claim for compensation under section 169 of the Data Protection Act 2018, finding that while the claimant averred distress, stress, anxiety and frustration, no details were provided as to how or when those effects manifested. Claims for financial loss arising from legal expenses, as well as an alleged disadvantage, were also dismissed due to a lack of sufficient specification.
In Henderson v The Scottish Ministers [2026] SC GLA 104, published last week, the sheriff also rejected a claim for damages arising from an admitted data breach, holding that evidence of psychiatric injury and distress was found to be neither credible nor reliable, and self-reported symptoms were unsupported by the contemporaneous medical records. The expert psychiatric diagnosis, founded entirely on the pursuer’s own account taken at face value, was given no weight.
The decisions reinforce that, whilst there is no formal threshold of seriousness, the onus of proving real, causally connected damage remains firmly on the claimant. Self-reported distress unsupported by independent evidence will not suffice.
While these cases concern individual claims, they sit within a broader landscape of expanding collective redress activity in Scotland. The emergence of certified group proceedings arising from data incidents – with three such proceedings underway to date – underscores the increasing use of Scotland’s group litigation framework for data protection claims.
The damage threshold principles confirmed in Prentice and Henderson carry particular significance in this context. Opt-out class proceedings face an inherent structural challenge in demonstrating individualised, causally connected harm across a large and diverse class. Where courts require more than bare assertions of distress, the task of establishing compensable damage at scale becomes materially more difficult for representative parties to discharge.
For Controllers, the message from these two decisions is one of cautious reassurance. Scottish courts will hold claimants, whether proceeding individually or as part of a class, to the evidential standard that the law demands. A breach alone opens no door to an award. That said, the volume of certified class proceedings is a reminder that robust data governance remains not just best practice, but the surest defence.
On 7 and 8 October 2026, the Supreme Court will consider the issue of whether a threshold of seriousness applies to claims for damages under the GDPR and Data Protection Act 2018 in Paymaster (1836) Limited v Farley and others – which will provide authoritative clarity to these issues.