Quick quit Skip to content

Compensation for damage to victims of a data protection offence or data leakage

When your personal data has been taken, disseminated, or used without your consent, you may be entitled to compensation for the damage caused to you by the act.

It is important that you

  • keep records of incidents and damages, and save receipts or other verifications and documents related to them
  • find out who is responsible for the damages and from whom you can possibly claim damages
  • check if your insurance covers damages.

Compensation may be granted in some cases, for example:

  • the costs of measures to protect you from major damages, such as a credit ban
  • emotional suffering
  • financial damages caused by the misuse of your personal data, such as taking instant loans in your name.

If you suspect a crime, report it. In this case, you can file claims for compensation against the suspect. Read about crime-related damages on the website of Victim Support Finland

If your data has been stolen or leaked from a company or another organisation, the organisation may have violated the EU General Data Protection Regulation (GDPR). In this case, you can claim for compensation directly from the organization. Read about claiming damages under the General Data Protection Regulation on the website of the Office of the Data Protection Ombudsman


Note: For example, if there are a large number of victims in a data breach, it is unlikely that prosecutors would pursue victims’ claims for compensation in criminal proceedings. In practice, victims should be prepared to present their own claims for compensation against the offender. During the hearing, the victim may state that he or she has claims for compensation and ask the prosecutor to pursue them. In this case, the victim must also state what he/she is claiming compensation for and to what extent, as well as provide the police with written explanations/evidence of the damage. If the victims declare that they will pursue the claims for damages themselves, they should contact a lawyer at the latest when they receive documents from the district court.

The assessment of the prosecutors’ possibilities to pursue damages is based on the instructions of the Prosecutor General (2006:3), which states: If, however, the number of plaintiffs is exceptionally large, the pursuit of all their civil claims may together constitute a substantial inconvenience to the prosecution, even if the claim of an individual plaintiff would not.