What responsibility does a company have after they have fallen victim to a targeted hack/ransomware attack?

And what responsibilities does an individual have if they know of such as issue, which is ongoing, and hasn't been acknowledged by the company?

  • 8
    This needs a specialized lawyer consultation NOW. Jan 14, 2020 at 7:33
  • 4
    I'm voting to close this question as off-topic because this needs professional legal advise. Jan 14, 2020 at 7:34
  • 4
    If this breach of security affects personal data, the company must likely send a data breach notification to the ICO without undue delay. An individual has no obligation to notify anyone of the company's problems.
    – amon
    Jan 14, 2020 at 8:45
  • 3
    Voting to reopen... the OP is probably an employee seeking clarification not as a high level exec trying to figure out if he should or should not release this info.
    – Dan
    Jan 14, 2020 at 13:42
  • 3
    @Dan thats correct
    – Karm
    Jan 14, 2020 at 13:57

1 Answer 1


First: I am not a lawyer and this is not legal advice. Also, I assume for the purposes of this answer that the company is both a controller and a processor of personal data. (for Definitions see Art. 4 GDPR)

Does it need to be reported?

In case of a personal data breach, Art. 33 (1) GDPR says the controller needs to:

[...] without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority [...]

If you look at Art. 4 (12) GDPR (Definitions), you'll find personal data breach being defined as follows:

(12) 'personal data breach' means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Art. 33 (1) GDPR goes on to say:

[...] unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. [...]

You may also be interested to know that a processor is required by the GDPR to "implement appropriate technical and organisational measures" (Art. 32 (1) GDPR) (sometimes called TOMs) to protect the rights and freedoms of data subjects. This includes "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident" (Art. 32 (1)(c) GDPR)

So in short, it really depends on how sure the controller is whether there was ever a risk to the rights and freedoms of the data subjects.

I can't judge that risk in your case, but given the nature of malware, you know, I would be pessimistic.

What responsibility do individual employees have?

That depends on a million things, I don't want to make a prediction as to what will happen if the individual stays quiet.

If the company has a data protection officer they would be a good person to talk to. One of the tasks of a data protection officer is "to inform and advise the controller or the processor and the employees who carry out processing of their obligations [...]". (Art. 39 (1)(a) GDPR) While the DPO can sometimes be an employee of the company, they have a duty to the data subject and will avoid a conflict of interest.

If the employee fears getting in trouble with their employer for reporting a possible violation, well, that fear may be justified. It's been known to happen. It's of course possible to talk to the DPO anonymously (although the employer may still be able to figure out who it was).


If you ask this kind of question on the internet, the first response will always be "talk to a lawyer now!". That is of course the best possible advice, but sometimes you may be in a situation where talking to a lawyer is infeasible. With GDPR violations, luckily you have the DPO and the supervisory authority on your side, they will talk to you for free.

Also consider just reading the GDPR (the actual text, not articles about it). It looks scary, but it's not that difficult to understand and it's not that long.

Lastly, specific questions about local laws can be posted on https://law.stackexchange.com/.

  • Thanks for taking the time to reply. Loads of info there, looks like I've got a bit of reading to do.
    – Karm
    Jan 16, 2020 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .