Eleanor VaughanWith The Sun's publisher News Group Newspapers posting pre-tax losses of £53 million for the year ending July 2025 — and phone-hacking legal costs more than doubling to £36.7 million — the UK's most-read tabloid is once again dominating headlines for the wrong reasons. Now that landmark settlements, including a £15 million deal with the Duke of Sussex concluded in January 2025, have formally closed the celebrity chapter, a quieter group of people is asking a pressing question: what rights do ordinary UK residents have over the data The Sun may have collected about them?
What Is Actually Happening at The Sun Right Now
The Sun's accounts, filed with Companies House in early 2026, reveal a publication in structural decline. Advertising revenues fell sharply after Google algorithm updates cut organic search traffic, while phone-hacking litigation costs swallowed £36.7 million — more than double the £16 million recorded the previous year. Cumulative losses over fifteen years now exceed £1.3 billion, according to analysis by Press Gazette.
Circulation tells a parallel story. In 2010, The Sun sold 2.9 million copies daily, making it the UK's best-selling newspaper. By September 2026, industry insiders estimate fewer than 500,000 print copies leave the presses each morning. The tabloid has not submitted its figures for independent audit since 2020, meaning even that estimate is uncertain.
For readers and former sources, however, the most significant development is not the balance sheet. It is the formal acknowledgement, made through multiple court settlements and admissions, that The Sun's publisher engaged in unlawful data-gathering on a systematic basis for more than a decade. That acknowledgement carries legal consequences that extend well beyond the claimants who sat in court.
The Question Readers Are Actually Asking
Can ordinary people — not celebrities, not public figures — find out whether The Sun held unlawful or undisclosed information about them?
The answer is yes, and the mechanism is simpler than most people assume.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, every individual has the right to ask any organisation — including a newspaper publisher — exactly what personal data it holds about them. This is called a Subject Access Request (SAR). A SAR costs nothing to submit, must be answered within one calendar month, and requires no solicitor to initiate.
Crucially, the right covers not just data the organisation collected directly, but information obtained through third parties — including, in principle, data gathered by private investigators acting on the publisher's behalf. The Information Commissioner's Office (ICO), the UK's independent data protection regulator, provides free guidance and a formal complaints route for people whose SARs are ignored or inadequately answered. Full guidance on Subject Access Requests is available at the ICO's official website.
Why This Matters Beyond Phone Hacking
The phone hacking scandal centred on voicemail interception. But court documents released during the NGN litigation in 2024 and 2025 revealed a broader range of unlawful techniques: hiring private investigators to "blag" financial records, obtaining medical information through deception, and commissioning searches of private databases. These techniques were applied not only to named public figures, but to their associates, neighbours, family members, and professional contacts.
If any of these techniques were used to gather information about you — even as a minor character in a story, a relative of someone in the news, or an employee at an organisation The Sun was investigating — you may have a data subject access right, and potentially a right to compensation.
Under Article 82 of UK GDPR, individuals are entitled to compensation for material or non-material damage caused by unlawful data processing. Courts in England and Wales have confirmed that distress alone — without any financial loss — can found a claim. The Supreme Court's analysis in Lloyd v Google LLC [2021] UKSC 50 clarified that "uniform" damages across large claimant groups face obstacles, but individual claims with particularised evidence of distress remain viable.
For related insights into how UK media outlets handle personal data and what recourse individuals have, see our analysis of the right to be forgotten in the regional press context.
If The Sun Investigated Someone You Know: A Concrete Scenario
Consider a secondary-school teacher in Sheffield — call her Claire — whose older brother was peripherally mentioned in a Sun investigation into a local businessman during 2008. Claire was never named in the published article. But a court document released during the NGN litigation in 2024 referred to investigators being tasked with "background profiling" of family members and associates of named subjects — a standard practice during that period.
Under UK GDPR, Claire can submit a SAR to News Group Newspapers at its registered address: Data Protection Officer, News Group Newspapers, 1 London Bridge Street, London SE1 9GF. She should state clearly that she is making a Subject Access Request under Article 15 of UK GDPR, and request all personal data held about her, including data obtained through third-party contractors.
NGN must respond within 30 calendar days. If it fails to do so, Claire can file a complaint with the ICO free of charge. The ICO has formal enforcement powers, including the ability to issue fines of up to £17.5 million (or 4% of annual global turnover) for serious breaches.
If Claire can demonstrate that distress arose from the possibility that her personal data — phone records, financial details, medical information — was accessed without her knowledge, she may have grounds for a civil compensation claim. Solicitors specialising in data rights and media privacy typically offer conditional-fee arrangements, meaning no upfront legal cost. Compensation in analogous non-celebrity phone-hacking cases has ranged from approximately £3,000 to £25,000, depending on the severity of the suspected intrusion and the evidence available.
The if/then logic is straightforward: if you were connected to a person The Sun was investigating at any point between 1996 and 2011, and if you have reason to believe that background profiling extended to you, then you have legal grounds to submit a SAR at zero cost. If NGN does not respond fully within 30 days, you can escalate to the ICO at no charge. And if a solicitor assesses that the evidence supports a non-trivial distress claim, a compensation case can proceed with no financial risk to you.
What the Limitation Period Means for Your Window
Many people assume that claims for events in the 2000s are now out of time. This is not necessarily correct. Under the Limitation Act 1980, the usual six-year limitation period for data protection claims runs from the date the cause of action accrued — and courts have, in a number of NGN-related cases, held that the clock starts not when the intrusion occurred, but when the claimant first had reasonable grounds to suspect it. For some people, that moment only arrived when court documents became public during the 2024 and 2025 hearings.
This means that for some individuals, the limitation window opened relatively recently. A legal expert can assess your specific circumstances and advise whether a claim is still live.
Important: This article provides general information about UK GDPR rights and is not legal advice. Individual situations vary. Consult a qualified solicitor before taking any formal legal action.
What to Do Now
If you believe The Sun may have held information about you, here are four immediate steps:
Submit a SAR in writing. Address it to the Data Protection Officer at News Group Newspapers, 1 London Bridge Street, London SE1 9GF. State clearly that you are making a Subject Access Request under UK GDPR Article 15 and request all personal data held about you, including data obtained through third parties.
Use recorded delivery or email with a read receipt. NGN has 30 calendar days to respond. Document everything.
If NGN fails to respond, contact the ICO. The ICO's complaint process is free and can compel a response. NGN's registration with the ICO is publicly verifiable at ico.org.uk.
Consult a data-rights solicitor. Many offer a free initial consultation and work on no-win, no-fee terms. A legal expert can evaluate whether your circumstances support a compensation claim and help you structure your SAR to maximise the information returned.
The Sun's financial crisis has focused media coverage on Murdoch succession plans and dwindling print sales. But for anyone with even a tangential connection to a Sun investigation from the 1990s through the 2010s, the more immediate story is the one about their own data — and what UK law now allows them to do about it.
