Update Data Protection No. 123
Cyberattacks – Effective prevention and appropriate response in the event of an attack
As companies increasingly go digital, incidents and attacks against company IT infrastructures (“IT security incident”) are also multiplying. Such incidents refer to events that influence or can influence the security of information, and consequently the confidentiality, availability and integrity of data. IT security incidents are often carried out in a targeted manner by attackers (“cyberattack”). Cyberattacks can have severe consequences for the companies attacked, sometimes even leading to an outage of the whole IT infrastructure; they can also cause vital restrictions on internal and external business operations. In turn, this can have a significant impact on the company’s reputation in the market. Where a cyberattack aims to acquire data and this affects personal data, it becomes a personal data breach within the meaning of Art. 4 (12) GDPR. Once the incident has been identified, the controller is under the obligation to notify the competent supervisory authority without undue delay, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
B. Current cases of cyberattacks
The following cases of cyberattacks have recently been identified at well-known companies or public bodies:
|As soon as a cyberattack makes unauthorized access to personal data possible, or publishes such data, it becomes a data protection issue. In the case of a personal data breach, the controller must, without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the competent supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons (see Art. 33 GDPR). Fines can be imposed for a delay in reporting or a failure to report (see Art. 83 GDPR).|
Fines associated with infringements of the obligation to report can involve significant sums:
In the event of an infringement of the obligation to report after a cyberattack, it is not the data protection officer of the company who is considered the controller within the meaning of the GDPR (Art. 4 (7) GDPR). Rather, the management of the company is the responsible organ to which the duty to report without undue delay falls (see the judgment of the Labor Court of Heilbronn on Ref. 8 Ca 135/22).
D. Recommended prevention measures
The following measures in particular are recommended to provide reasonable protection for companies against cyberattacks and to minimize the risk of a successful cyberattack:
E. Recommended response measures
Crises should always be handled on an individual basis and measures must be adapted to the particular case, especially the on-site IT infrastructure, the type of attack and the objective.
It is essential, on the one hand, to preventatively minimize the risk of a cyberattack and, on the other hand, to prepare preventative measures for the event of a cyberattack. The specific shape of the measures for both prevention and follow-up management mainly depends on the individual circumstances of a given company. We have developed a consultancy package, described here, for prevention and response measures that comply with the law. You can download a detailed overview of German IT security law from Legal 500 using this link. Our cybersecurity consultancy offer is available on our website.