Ransomware: incident response from a legal perspective

Legal basis and obligations

Ransomware attacks touch on a wide range of legal provisions, in particular the General Data Protection Regulation (GDPR).

Data protection requirements

The controller bears primary responsibility for compliance with data protection requirements. It must implement appropriate technical and organisational measures to protect personal data and, in the event of a data breach, fulfil the statutory reporting and notification obligations towards data protection supervisory authorities and, where applicable, data subjects.

Processors are obliged to inform the controller of security incidents without undue delay so that the controller can take the necessary steps in turn.

Reporting obligations

Entities subject to the BSI Act, NIS2, DORA or the Cyber Resilience Act must report security incidents to the competent bodies (e.g. the Federal Office for Information Security, BSI) where the legal requirements are met.

Sanctions and fines

Breaches of reporting obligations may result in fines. However, fines are also conceivable if circumstances come to light that made the cyberattack possible in the first place, for example if the company failed to implement appropriate technical and organisational measures to prevent and handle ransomware attacks.

Criminal law aspects

A ransomware attack may also be relevant under criminal law. Although an affected company is not obliged to file a criminal complaint, doing so may be advisable for reasons of preserving evidence and settling claims. Insurers also frequently require the incident to be reported to the police.

Civil liability and recourse

Under civil law, the main risk is claims for damages from data subjects and/or business partners. Data subjects may, under certain circumstances, claim compensation for material and non-material damage.

Recourse claims may also arise between business partners, for example if a processor has breached its obligations to secure data under the data processing agreement pursuant to Article 28 GDPR, or if contractually guaranteed services cannot be provided (on time) due to an attack-related outage. It is important to be aware of these risks, to examine claims and, where necessary, to defend against or enforce them.

Insurance cover and policyholder obligations

If a cyber insurance policy is in place, it must be checked which obligations and duties arise from the insurance contract, so as not to jeopardise insurance cover and, where necessary, to coordinate further measures.

Different issues in different scenarios

It is also important to consider the different scenarios in which ransomware attacks can become relevant. Even if the attack does not occur within your own company but at a service provider, for example, this can have significant consequences for your own company.

Your own security incident: obligations and communication

If a company itself falls victim to a ransomware attack in which, for example, its own customer or employee data is encrypted and/or stolen, this will generally constitute a personal data breach. In this situation, the company as controller must examine its own obligations, e.g. whether notification to the supervisory authority is required.

Where applicable, the data subjects and/or business partners must also be notified. Transparent communication with customers and authorities can help to limit reputational damage. However, the internal and external communication strategy should be carefully coordinated and accompanied by legal advice, particularly in view of any liability risks.

Reports from forensics service providers and similar documentation should also be legally reviewed, as even minor inaccuracies in wording, for example, can have a significant impact on liability and insurance issues.

In advance, companies should above all have internal emergency plans in place that set out clear responsibilities and procedures. These should be tested under real-life conditions.

Incident at a service provider or processor

If a service provider or processor falls victim to a ransomware attack, the situation is more complex. On the one hand, it is itself affected and has its own obligations (e.g. as controller for its own employee data); on the other hand, it may also have specific obligations towards its business customers. For instance, the processor must inform the controller of an incident “without undue delay” (and not merely within 72 hours, as applies to the controller itself).

In addition to the risk of fines and liability towards data subjects, late notification can also have serious contractual consequences in relation to the contractual partner. Many contracts contain specific reporting deadlines, requirements for communication channels and liability provisions. A well-organised and documented approach is therefore essential.

The service provider should obtain legal support for all steps at an early stage in order to minimise liability risks. Here too, in addition to “whether” and “when” to inform, “how” and “what” are crucial in order to manage its own liability risks, avoid breaching other confidentiality obligations and protect business relationships. On the one hand, it may be advisable not to be overly candid about its own failings (which may not even have caused the attack); on the other hand, transparent communication fosters the trust of contractual partners or data subjects who have suffered harm.

Statutory reporting obligations must, of course, be fulfilled in full. However, caution is required, particularly when submitting your own notification to the supervisory authority. Prematurely providing information about other controllers who are also affected may, for example, result in those controllers becoming the subject of investigations by the supervisory authority.

Indirect impact through incidents in the supply chain

If a company is informed by one of its service providers that the provider has fallen victim to a ransomware attack, the company itself may be affected because its data is stored or processed by the service provider.

If the company receives notification of the incident from the service provider, it must examine without undue delay whether its own data is affected and whether a reporting obligation exists. It is not sufficient to rely on the service provider's information. The question may also arise as to whether the company has properly fulfilled its duties to select and monitor the service provider.

If the security assessment or ongoing monitoring of the service provider was inadequate, supervisory measures and fines for negligent selection may follow. In such cases, companies should therefore carefully review both the data processing agreement and the technical and organisational measures implemented.

Contractual provisions should also be reviewed to ensure that the service provider supplies the information required for the company's own obligations in a timely and meaningful manner and provides the necessary support. It helps if specific and comprehensive agreements that take cyberattacks and their consequences into account were concluded in advance.

Strategic prevention and the right response in an emergency

Ransomware can hardly be avoided entirely, but legal and organisational preparation can significantly limit the damage.

Careful contract drafting is essential. Data processing agreements and service agreements should contain clear incident response clauses that govern deadlines, escalation levels and communication channels. Limitations of liability and recourse mechanisms should be worded precisely in order to provide a legally sound basis in the event of damage.

Technical and organisational protective measures

Technical and organisational measures are also indispensable. These include encryption, strict access and authorisation concepts, regular data backups, network segmentation and the use of multi-factor authentication. Regular security audits and penetration tests help to identify vulnerabilities at an early stage. Meaningful system logs make it possible to establish the cause, course and extent of cyberattacks.

Effective security management also includes training and awareness-raising for employees. Many attacks begin with phishing emails or social engineering attempts. Training the workforce regularly reduces the risk.

Preparation and ability to act in an emergency

Finally, preparing for an emergency is also part of prevention. Companies should develop clear emergency and communication plans, designate external experts (IT forensics specialists, specialised lawyers, PR consultants) in advance and check whether they have cyber insurance with adequate cover.

An audit of existing contracts and contract templates also makes it possible to understand your own obligations in a structured way and to ensure that appropriate obligations have been agreed with contractual partners. This allows you to remain agile and able to act in an emergency, both during and after an attack, as well as during the subsequent review and any legal follow-up issues.

Conclusion

A ransomware attack is not just a technical crisis but always a legal emergency as well. Companies have to make numerous decisions with legal consequences within a very short time: from reporting and informing data subjects to communicating with authorities and business partners and enforcing and/or defending against legal claims.

Established and tested emergency concepts with clear responsibilities and procedures, proper documentation of the incident and a transparent but legally reviewed information policy are key elements of a legally sound response. Those who take precautions early on, clarify and regulate obligations and duties between all conceivable stakeholders and establish legally robust processes can manage legal risks in advance and act quickly and in a controlled manner in an emergency, thereby protecting the company's economic position and reputation.