Online recruitment site Monster.com could face legal action from 4.5m UK job seekers after hackers stole personal details from users around the world.
Monster this week admitted that its database had been compromised and names, passwords, telephone numbers and e-mail addresses were taken.
Users should keep any records they can to prove what costs they incurred as a result of Monster's failure to protect their personal data, said Hall.
This could include documents showing costs for transactions that have had to be reversed or fees that have been charged in connection with the breach.
"Anyone applying for compensation will need to prove that the breach at Monster led to the harm that they have suffered," she said.
Although individuals are entitled to claim compensation, Hall said a group action was always easier.
Monster could also face an enforcement notice from the Information Commissioner's Office, which is investigating the breach, she said