I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth were compromised.
As far as I know under GDPR data controllers can only hold data for as long as they have grounds to process it - does anyone know what this means in practice for HR and financial records? (e.g. why would they need my bank details for over a year after they had stopped paying me?)
I'm wondering whether I have grounds for compensation or to sue my ex-employer for keeping such sensitive data for so long and letting it be compromised.
Jurisdiction is England and Wales.