Church Redress Scheme data breach – what are the options for survivors now?
Bolt Burdon Kemp is demanding urgent action after a data breach exposed the email addresses of almost 200 people linked to the Church of England’s abuse compensation scheme.
On 26 August 2025, Kennedys, the law firm appointed to administer the Church of England’s Redress Scheme, sent an email to 194 individuals, inadvertently displaying the addresses of all recipients who had registered to receive updates on the scheme.
The Redress Scheme, approved by the Church’s governing body just a month earlier in July 2025, was created to offer tailored compensation and support to survivors of abuse within the Church of England. It is likely many of those affected by the breach were survivors of abuse themselves.
While any data breach is serious, this incident is especially concerning. For survivors of abuse, it risks compounding their trauma, particularly as they have already been seriously let down by the institutions meant to protect them.
On 27 August 2025, Hayley Chapman-Todd, a Senior Solicitor in the Abuse team at Bolt Burdon Kemp LLP, published an open letter to the Redress Scheme coordinators. She called for immediate action and accountability, requesting the coordinators:
- Issue an apology to all those affected by the data breach;
- Self-refer the breach to the Information Commissioner’s Office, in accordance with obligations under data protection laws;
- Publish on the Church of England’s website the measures being taken to prevent future breaches.
This call to action aims to ensure accountability and give survivors the transparency and reassurance needed to restore confidence in the scheme.
You can read the full letter here.
Since then, Kennedys Law and the Church of England have issued statements apologising for the breach and confirming they have reported the incident to the Charity Commission, Information Commissioner’s Office and the Solicitors Regulation Authority.
In the meantime, while the scheme is not yet live (as it is awaiting Parliamentary approval), there are other options available for survivors of abuse within the Church of England.
I am a survivor of Church of England abuse, what are my options?
If you are a survivor of Church of England abuse, you may be entitled to compensation through the Criminal Injuries Compensation Authority (‘CICA’) or by bringing a civil claim.
You may pursue both a claim to CICA and a civil claim, but you cannot be compensated twice for the same injury, so any award received from CICA must be repaid if you later receive compensation through a civil claim.
CICA
The CICA is a Government-funded body that allows victims of violent crime, including sexual abuse, to apply for compensation.
In order to make an application to CICA, you must:
- Report the abuse to the police; and
- Submit an application within two years of the incident. Or, if the crime occurred when you were under 18, within two years of either your 18th birthday or within two years of reporting to the police.
More information about CICA claims can be found here.
Civil claim
A civil claim is a claim brought in the civil, rather than criminal, courts. This involves bringing a claim against either the abuser themselves, or the institution responsible for them (such as the Church), for compensation for what happened and any other losses caused as a result of the abuse. This could include, for example, the costs of therapy or medical treatment.
Whilst civil claims for abuse are generally subject to a three-year time limit, or until a survivor’s 21st birthday if the abuse occurred in childhood, this deadline can be extended where there is a good reason for delay, and a fair trial remains possible.
Bolt Burdon Kemp LLP has a team of specially trained lawyers who act for survivors of abuse, including survivors of abuse within religious organisations, and survivors whose claims are not brought within the three-year time limit. If you would like to explore your options for compensation in confidence, you can contact a member of the Abuse team.
I have been affected by the Church of England Redress Scheme data breach, what can I do?
The Information Commissioner’s Office (ICO) is the independent authority that enforces data protection laws in the UK.
If your personal information has been disclosed without your permission, you can make a complaint directly to the ICO. Please see the ICO website for further details.
You may also be entitled to compensation for distress caused by the breach of your personal data. If you would like to discuss this further, our Abuse team would be happy to speak with you.
