Meet the lawyers we work with: Tracy Chick

Failure To Use BCC Data Breach Compensation Claims

By Stephen Moreau. Last Updated 11th September 2025. Is not using BCC a breach of UK GDPR? In some cases, yes, it could be. A failure to use BCC could be caused by human error.

And when such an error results in your personal data, which is protected by law from being exposed, it could be possible to claim compensation for a failure to use BCC data breach.

We may not answer every question you have in this guide, as each claim for data breach compensation is unique in some way. But we can still provide you with answers if you speak to one of our claim advisors. You can call us on 020 3870 4868 or contact us by filling out our contact form. Our advisors can also help you get a claim started as soon as possible. So don’t delay, call us today.

Select A Section:

What Is A Failure To Use BCC Data Breach?
What Is The Difference Between CC and BCC?
Is Sharing An Email Address A Breach Of UK GDPR?
How Could Organisations Reduce The Risk Of Email Data Breaches?
What To Do If Impacted By A CC Instead Of BCC Mistake Under UK GDPR?
Calculating Damages For A Failure To Use BCC Data Breach
Begin Your Failure To Use BCC Data Breach Claim Today

What Is A Failure To Use BCC Data Breach?

Is revealing my email address a breach of data security laws? It can be in certain circumstances. When UK data protection and privacy laws have been broken and this has led to personal information being breached, then a data breach victim could be eligible to claim compensation. One way a data breach can happen via your email address is in a failure to use BCC.

Generally, when a mass email is sent to lots of people who are unaware of each other, the email addresses of recipients should be hidden from all other recipients by using the BCC box. However, mistakes can be made, such as using the CC box by mistake (more on this below).

Data breaches can happen for all different types of reasons. Not every data breach that occurs will mean those affected can make a data breach compensation claim. A successful data breach claim requires you to prove that your personal data was affected. It will also show a liable party. This means proving that those who should have been protecting your data failed to do it adequately. This will need to have caused you emotional harm and/or financial costs.

What Is The Difference Between CC and BCC?

If you are unsure of how an email system works, you might not understand the difference between CC and BCC. So we have explained them below.

Carbon Copy (CC) – Email addresses added to the CC box will show to all recipients of the email. The CC box is used when you want everyone to know that other people have copies of the email. And when everyone to whom the email was sent is allowed access to everyone else’s email address.
Blind Carbon Copy (BCC) – Email addresses added to the BCC box are not visible to any recipients. The BCC box is used when sending mass emails. It protects every recipient from their email address being shared with everyone else. When BCC is not used appropriately, it could result in a data breach.

When To Use Blind Carbon Copy

What happens if you forget to BCC? Every email address to which the email is sent is visible to all other recipients. If you accidentally didn’t use BCC, you may have exposed personal data and caused a data breach. Generally, you should always use BCC when mass emailing people outside of your organisation.

Is Sharing An Email Address A Breach Of UK GDPR?

An email address is considered personal data because it could be used to identify a person. Therefore, sharing an email address is a breach of UK GDPR if the sharing does not meet one of the lawful bases of processing.

Namely;

Consent: If it is shared in a way that the person did not consent to
Contract: If the sharing was not necessary to fulfil a contract you had with the person
Legal obligation: If the sharing was not necessary to comply with the law
Vital interest: If the sharing was not done to save someone’s life
Public task: If the sharing was not in the public interest
Legitimate interests: If you cannot present legitimate reasons for the sharing of a person’s personal data.

Sharing an email address without permission in the UK could lead to a data breach claim.

If your email address was shared unlawfully, please reach out to an adviser now to discuss if you are eligible to claim.

How Could Organisations Reduce The Risk Of Email Data Breaches?

A lack of awareness is one reason why a failure to use BCC data breach can happen. Staff should be trained in what data privacy laws require of them. Some examples are shown below.

Foster a corporate culture that places data privacy at the fore.
Ensure staff receive updated training when data privacy laws change.
Make individuals responsible for ensuring they approach data privacy correctly.

What To Do If Impacted By A CC Instead Of BCC Mistake Under UK GDPR?

In the UK, the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR) protect personal data. Under this legislation, unless there is a lawful basis for doing so, sharing emails without permission could be considered a personal data breach. This is because an email address is considered to be personal data.

You may wonder what you could do after a data breach caused by a CC instead of a BCC mistake. The GDPR, under UK legislation, allows you to claim compensation should this occur. However, you must be able to prove that:

The breach occurred as a result of wrongful conduct.
It affected your personal data.
You suffered financial or emotional harm.

There are other steps you may wish to take as well. Some of these could help support a data breach claim. You could:

Contact the organisation that you suspect breached your personal data. They may confirm that your personal data was breached with a letter of notification. An organisation must inform you of a breach of your personal data without undue delay if it presents a risk to your rights and freedoms.
Report the breach to the ICO. As part of its role in protecting data rights, the ICO can investigate certain data breaches and issue fines. However, they cannot pay compensation. If you decide to report to the ICO, you must do so within three months of your last meaningful communication with the organisation.
Gather any evidence relating to the harm you have suffered. For example, credit card and bank statements could help with proving your financial losses. A copy of your medical records could help with proving the psychological harm you have endured.

You can discuss your potential options following a breach of your personal data with one of our advisors using the contact details at the top of the screen.

Calculating Damages For A Failure To Use BCC Data Breach

To calculate damages for a failure to use BCC data breach claim, solicitors use information supplied by the Judicial College Guidelines. This document is useful to them, as it pairs suggested compensation with various forms of harm, including psychological damage.

We used the guidelines to create the table below, but it should be noted that the top row is not from the JCG. Moreover, the table isn’t a guarantee of how much compensation you might receive for psychological harm, such as anxiety after a data breach.

Edit
Psychological Injury	Information	How Bad?	Damages
Severe psychological harm and economical losses	The claimant could receive a payout for both a very severe psychological injury and any resulted financial losses, such as harm caused by a damaged credit score.	Very Severe	Up to £250,000+
Psycholgical Injuries	People with severe mental illnesses have difficulties with their work, home lives, and education, for example. Their chances of recovering are slim.	Severe	£54,830 to £115,730
Psycholgical Injuries	Work, relationships, and other activities may be challenging for the sufferer.	Moderately Severe	£19,070 to £54,830
Psycholgical Injuries	The chances of such a person making a full recovery are high, despite their mental health concerns initially.	Moderate	£5,860 to £19,070
Psycholgical Injuries	A patient in this category will receive compensation depending on how much and how long he or she suffered from the mental injury.	Less Severe	£1,540 to £5,860
PTSD (Post Traumatic Stress Disorder)	Individuals suffering from PTSD will be severely affected by the disorder and will not be able to function normally.	Severe	£59,860 to £100,670
PTSD (Post Traumatic Stress Disorder)	The impact of PTSD on an individual’s life may be significant, but they have a good likelihood of some recovery.	Moderately Severe	£23,150 to £59,860
PTSD (Post Traumatic Stress Disorder)	Since the patient has almost entirely recovered, residual symptoms will not cause significant disability.	Moderate	£8,180 to £23,150
PTSD (Post Traumatic Stress Disorder)	In this category the claimant should be recovered from any PTSD symptoms in 2 years.	Less Severe	£3,950 to £8,180

The table only covers non-material damage, such as stress caused by a data breach. You may have also lost out monetarily due to the data breach, which you may be able to recover in a claim. However, you will need to submit documented evidence of losses in order to claim for this material damage. Please talk to one of our claim advisors for more help with this.

Begin Your Failure To Use BCC Data Breach Claim Today

You can begin your failure to use BCC data breach claim today by reaching out to our friendly team of advisors. They work around the clock to answer any questions you may have and can provide a free, no-obligation assessment of your claim. If your case is strong, you could be connected with one of the expert No Win No Fee solicitors from our panel.

By claiming compensation on No Win No Fee terms through a Conditional Fee Agreement (CFA), you will not be asked to pay any solicitor service fees:

At the start of your claim.
During the claims process.
If your claim is unsuccessful.

Should you win, you’ll only be required to pay a small success fee to your solicitor. The success fee percentage is legally capped and will be subtracted from your compensation.

Not only do CFAs ensure you keep the bulk of the compensation, but they also help you access a range of high-quality services without the worry of spiralling solicitor fees. Those services include:

Advice that strictly adheres to the rules of confidentiality.
Regular claim updates.
Explanations of key legal terminologies and assistance with signing documents.
Help with arranging counselling sessions to support the healing process.
Help with gathering a strong body of evidence.

To learn more about the benefits of CFAs, please get in touch with one of our friendly advisors today. They can also provide free advice about your case and the steps to making a failure to use BCC data breach claim. You can get in touch by:

Calling us on 020 3870 4868
Contacting us through our online claim form
Messaging our 24/7 live chat service

Learn More About Breaches Of The UK GDPR

Meet The team

Tracy Chick

Tracy Chick stands as a dedicated and expert Personal Injury and Road Traffic Accident lawyer, distinguished by her prestigious MASS Diploma in the field. Her profound understanding of UK road traffic law is not only applied daily in complex legal cases but also shared through her contributions to various legal guides. Tracy has both authored and meticulously reviewed multiple comprehensive guides on UK law, solidifying her reputation as a knowledgeable and trusted voice in the legal community.