Breach of Confidentiality UK: Claim Your Rights

Overview

A breach of confidentiality happens when someone who has a duty to keep your information private shares it, uses it, or allows others to access it without your agreement. The duty itself can arise from a professional relationship, a contract, an employment setting, or simply from the nature of the information itself.

Courts in England and Wales recognise that certain categories of information carry an inherent expectation of privacy, including medical notes, financial records, legal correspondence, personal communications, and business secrets. The breach might be deliberate, such as a professional gossiping about a client, or accidental, such as an email sent to the wrong recipient.

It can also happen through poor security practices that let third parties access data they should not see. What matters legally is whether the information was confidential in nature, whether it was shared in circumstances that imposed a duty of confidence, and whether it was then used or disclosed in a way that was not authorised.

The law treats this seriously because so much of modern life depends on being able to trust the people we share information with.

Key steps

1. Gather the evidence. Start by writing down exactly what information was shared, who shared it, who received it, and when you found out. Keep copies of any emails, letters, messages, or documents that show the disclosure happened. Contemporary notes carry real weight if the matter later goes to court or an ombudsman.
2. Raise a formal complaint. Most regulated professionals have a complaints procedure, and many professional bodies require you to go through it before escalating. Write to the firm or individual setting out what went wrong, what harm it caused, and what outcome you want. Keep your tone factual and give them a reasonable deadline to respond.
3. Report to the relevant regulator. Depending on the profession, the regulator might be the General Medical Council, the Solicitors Regulation Authority, the Financial Conduct Authority, or another body. If personal data was involved, you can also report the matter to the Information Commissioner's Office, which oversees compliance with UK data protection law.
4. Quantify the harm you have suffered. Courts and regulators want to see what the breach actually cost you. This might include financial losses, medical expenses for distress-related treatment, lost earnings, or damage to your reputation. Keep receipts, medical notes, and any correspondence that shows the knock-on effects of the disclosure.
5. Consider your legal options. You may have grounds to bring a civil claim for breach of confidence, misuse of private information, or a statutory claim under data protection legislation. Time limits apply, so acting promptly matters. Getting guidance early helps you understand whether a claim is worth pursuing and what remedies might realistically be available.

Common questions