Your rights when your bank is hacked
A bank data breach is not just an inconvenience. Under UK GDPR and FCA rules, you have enforceable rights, including the right to compensation for distress, even without financial loss.
Compensation for
Distress alone
SAR response time
1 calendar month
FOS award limit
£455,000
Court claim limit
6 years
15th May 2026: joint statement on frontier AI and cyber resilience
On 15th May 2026, the Bank of England, the FCA and HM Treasury said that the cyber capabilities of current frontier AI models “are already exceeding what a skilled practitioner could achieve”, and that regulated firms need to plan for and mitigate those risks under their existing operational resilience rules. If your bank was breached by an AI-enabled attack it had not prepared for, you can point to this statement. It creates no new rights of its own.
What to do after a bank data breach
Six steps in order. Each one builds on the last.
Get a subject access request in immediately
Do this firstSubmit a SAR to your bank to find out exactly what personal data was exposed: names, addresses, account numbers, authentication details. The bank must respond within 1 calendar month (UK GDPR Arts 12(3) and 12A). This is your evidence base.
UK GDPR Article 15
Ask the bank what happened and what they're doing
Within 1 weekUnder UK GDPR Article 34, the bank must notify you directly if the breach is 'likely to result in a high risk' to your rights. If you found out through the media rather than from the bank, that's a separate complaint point: the bank may have failed its notification duty.
UK GDPR Article 34
Complain formally to the bank under DISP
Within 2 weeksFor FCA-regulated banks, lodge a formal complaint citing: (1) the data exposure, (2) any financial loss or distress, (3) where the attack disrupted the bank's services, the FCA's operational resilience rules (SYSC 15A), and (4) if the attack was AI-enabled, the regulators' joint statement of 15th May 2026 on frontier AI models and cyber resilience. The bank has 8 weeks to issue a Final Response Letter.
FCA DISP 1.3; SYSC 15A where services were disrupted
Complain to the Information Commission if the bank failed its duties
Within 3 months of the issueIf the bank failed to notify you in time, failed to secure your data adequately, or ignored your SAR, complain to the Information Commission (formerly the Information Commissioner's Office, ICO). Its investigations can lead to fines against the bank and produce findings that significantly strengthen your court claim.
UK GDPR + Data Protection Act 2018
Escalate to the Financial Ombudsman (if FCA-regulated)
After 8-week bank deadline passesIf the bank rejects your complaint or doesn't respond within 8 weeks, escalate to the FOS. The FOS can award compensation for distress and financial loss. The FOS is free and legally binding on the bank up to £455,000 (for complaints referred on or after 1 April 2026 about events on or after 1 April 2019).
FCA DISP 2.8
Consider a court claim for compensation
After exhausting other routesIf distress or financial loss was significant, a court claim under UK GDPR Article 82 and/or Data Protection Act 2018 s.168 may be appropriate. The small claims track is for claims of not more than £10,000. Section 168(1) of the Data Protection Act 2018 says the non-material damage Article 82 compensates includes distress, so a claim does not need a financial loss.
UK GDPR Art. 82 + DPA 2018 s.168
The AI angle: what the May 2026 statement means for your claim
The regulators' joint statement on frontier AI models and cyber resilience is relevant if your bank was compromised by an AI-enabled attack.
Regulators say frontier AI raises cyber risk
The Bank of England, the FCA and HM Treasury said on 15th May 2026 that 'the cyber capabilities of current frontier AI models are already exceeding what a skilled practitioner could achieve, and at a significantly higher speed, greater scale, and lower cost', and that firms that have underinvested in core cyber security fundamentals are likely to become progressively more exposed.
Banks must plan for it under existing rules
The statement asks regulated firms to plan for and mitigate frontier AI cyber risks in line with existing operational resilience rules. For banks and building societies these include FCA SYSC 15A, which requires them to be able to stay within impact tolerances for their important business services in a severe but plausible disruption.
It creates no new legal rights
The statement says it 'is not intended to introduce new expectations; it brings together and reinforces existing messages'. It does not give you a new claim. It does show that regulators treated frontier AI cyber risk as known, which you can point to when arguing that your bank's security was not adequate.
Common questions
What are my rights if my bank is hacked?
Under UK GDPR Articles 15-22 you have the right to know what data was exposed (Subject Access Request), to be notified if the breach is high risk (Article 34), and to claim compensation for financial loss and distress. For FCA-regulated banks, you can also complain under the FCA's DISP rules, and where the attack disrupted the bank's services, the FCA's operational resilience rules (SYSC 15A) may also be relevant.
Can I claim compensation from my bank after a data breach?
Yes. UK GDPR allows you to claim compensation for both material damage (financial loss) and non-material damage (distress). You can sue in court or complain to the Information Commission (formerly the ICO). For banks, you can also use the FOS if the breach involved regulatory failures.
What is the May 2026 Bank of England, FCA and HM Treasury statement on frontier AI, and does it matter for my claim?
On 15th May 2026 the Bank of England, the FCA and HM Treasury published a joint statement on frontier AI models and cyber resilience. It says the cyber capabilities of current frontier AI models 'are already exceeding what a skilled practitioner could achieve', and that regulated firms need to plan for and mitigate the cyber risks in line with existing operational resilience rules. It introduces no new expectations and gives you no new legal rights, but it shows the risk was known, which you can point to if your bank's defences against an AI-enabled attack were inadequate.
How long do I have to make a claim after a bank data breach?
You have 6 years to bring a court claim. For an FOS complaint (where the bank failed DISP standards), you must refer within 6 months of the bank's final response, and outer limits of 6 years from the event or 3 years from when you knew (or should have known) also apply. For Information Commission complaints, there is no strict deadline but acting within 3 months is recommended.
Start your data breach complaint now
Frank will help you draft your Subject Access Request, formal DISP complaint to your bank, and Information Commission complaint, all in one place. Motor finance (PCP and HP) claims are free, and so is checking any other case. Quick Resolution is £9.99 once for a straightforward case, and Starter is £19.99 a month.