TRW & Co · Technology, Data & IP
Cyber Security and Data Breach Lawyers in London
Data breach lawyers London organisations instruct manage the legal response to cyber incidents: deciding what to report and to whom within 72 hours, protecting privilege, handling ransom demands and defending regulatory action and claims. With the Cyber Security and Resilience Bill set to widen the UK's cyber rules, preparation now matters as much as speed after an attack.
Key pointInstruct lawyers before forensic investigators: an investigation commissioned for the dominant purpose of anticipated litigation has the best chance of staying privileged, while one commissioned by IT for operational reasons usually will not.
At a glance
72-hour regulator window
Personal data breaches that risk harming individuals must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness.
Wider NIS regime coming
The Cyber Security and Resilience Bill, introduced in November 2025, would bring managed service providers, data centres and critical suppliers into regulation.
Faster incident reporting
As drafted, the Bill requires an initial incident notice within 24 hours and a full report within 72 hours for regulated entities.
Ransom payment restrictions
The government announced in July 2025 plans to ban ransom payments by the public sector and critical national infrastructure operators.
Penalties for weak security
The ICO fined Capita £14 million in October 2025 after an attack affecting about 6.6 million people, citing slow alert response.
Swipe or scroll →
What data breach lawyers London organisations call actually do
Data breach lawyers London organisations call in a crisis handle the legal side of a cyber incident: deciding what must be reported and to whom, protecting privilege, dealing with attackers' demands, managing customers and counterparties, and defending the regulatory and civil claims that follow. Before an incident, the same lawyers help boards build the governance, contracts and response plans that make those decisions faster.
Cyber security law in England and Wales is not one statute. It is a stack of overlapping duties: data protection law for personal data, the Network and Information Systems Regulations 2018 for essential and digital services, sector rules for financial services, telecoms and energy, criminal law under the Computer Misuse Act 1990, sanctions law when a ransom is demanded, and ordinary contract and negligence law between businesses.
Every organisation that holds data or depends on IT is exposed. Ransomware, business email compromise, supplier compromise and insider data theft account for most serious incidents we see. The legal questions are the same whatever the vector: what happened, whose data or service was affected, what deadlines have started running and what must be preserved.
The legal and regulatory framework
Data protection
Under the UK GDPR, controllers must keep personal data secure (Article 32), report a personal data breach to the regulator without undue delay and, where feasible, within 72 hours unless it is unlikely to result in a risk (Article 33), and tell affected individuals where the risk is high (Article 34). The Data (Use and Access) Act 2025 aligned the separate PECR breach notification rule for telecoms and internet service providers with the UK GDPR from August 2025. Our data breach reporting guide walks through the reportability test.
Network and information systems
The NIS Regulations 2018 apply to operators of essential services in sectors such as energy, transport, health, water and digital infrastructure, and to relevant digital service providers including online marketplaces, search engines and cloud services. They require appropriate security measures and incident notification to the competent authority.
The Cyber Security and Resilience (Network and Information Systems) Bill was introduced on 12 November 2025 and, as of October 2026, is completing its passage through the House of Lords. As drafted, it would bring managed service providers and larger data centres into scope, let regulators designate critical suppliers, require an initial incident notification within 24 hours and a full report within 72 hours, and raise maximum penalties to £17 million or 4% of worldwide turnover for the most serious breaches. Much of the detail will follow in secondary legislation. Our Cyber Security and Resilience Bill guide tracks its progress.
Financial services and other sectors
FCA and PRA-regulated firms must notify their regulators of material operational and cyber incidents and maintain operational resilience frameworks with important business services and impact tolerances. Telecoms providers answer to Ofcom, and energy networks to their sector regulators. Our financial services regulation team advises on overlapping notifications.
Criminal law and the attacker
The Computer Misuse Act 1990 criminalises unauthorised access and impairment. Reporting through the regulator's breach reporting service is separate from reporting the crime. Reporting to Action Fraud or the police is usually advisable, and law enforcement can sometimes help with decryption tools or intelligence. Victims can also seek civil injunctions, including against persons unknown, to restrain the publication or use of stolen data.
| Recipient | When | Timing |
|---|---|---|
| Information Commissioner's Office | Personal data breach likely to result in a risk to individuals | Without undue delay; within 72 hours where feasible |
| Affected individuals | Breach likely to result in a high risk | Without undue delay |
| NIS competent authority | Operators of essential services and digital service providers, for incidents meeting the thresholds | Currently within 72 hours; 24-hour initial notice proposed in the Bill |
| FCA and PRA | Material incidents at regulated firms | Promptly, under each regulator's rules |
| Insurers | Under the cyber or other policy | As the policy requires, often immediately |
| Customers and counterparties | Where contracts require notice | As each contract specifies, sometimes 24 to 72 hours |
The first 72 hours: how a breach response runs
The first three days decide most outcomes. Data breach lawyers London businesses retain in advance can be on a call within the hour, and the order of work matters as much as the speed.
- Contain and preserve. Isolate affected systems, but preserve logs, images and attacker communications. Destroying evidence while remediating is the most common avoidable error.
- Engage advisers under privilege. Instruct lawyers first and have them retain forensic investigators, so that investigation reports have the best chance of attracting legal professional privilege.
- Notify insurers. Most cyber policies require prompt notice and use panel vendors; acting outside the policy can jeopardise cover.
- Assess what was affected. Establish which systems, data sets and people are involved, and whether data was accessed, encrypted or exfiltrated.
- Make the reporting decisions. Decide on notifications to the regulator, individuals, sector regulators, customers and law enforcement, and record the reasoning.
- Handle any extortion demand. Assess sanctions, terrorism-financing and regulatory risks before any engagement with the attacker, and agree a communications line.
- Communicate consistently. Align statements to staff, customers, the market and the press with what the evidence actually shows.
- Remediate and learn. Fix root causes, update the risk register and report to the board, because regulators will ask what changed.
Regulators forgive organisations that were attacked. They are far less forgiving of organisations that knew about a weakness and did nothing.
Key decisions: reporting, ransom and disclosure
Report or not?
The threshold for reporting to the regulator is low: any risk to individuals. The threshold for telling individuals is high risk. Over-notification causes alarm and claims; under-notification invites enforcement. The answer depends on the data involved, whether it was encrypted, whether it has been published and what mitigations exist. A documented decision taken on day two is more defensible than a perfect one taken on day ten.
Paying a ransom
Paying a ransom is not generally a criminal offence in the UK, but it can become one. A payment that reaches a person subject to UK financial sanctions breaches sanctions law, and payments that fund terrorism engage the Terrorism Act 2000. Payment does not guarantee deletion of stolen data and does not remove the duty to notify. In July 2025 the government confirmed it intends to ban ransom payments by public sector bodies and operators of critical national infrastructure, and to introduce a payment prevention and mandatory reporting regime for others. Check the current status before any decision, and see our sanctions team's guidance.
Market and contractual disclosure
Listed companies must consider whether an incident is inside information that must be disclosed to the market. Private companies face contractual notification duties to customers, lenders and partners, often with short deadlines. Data breach lawyers London companies use will map these obligations alongside the statutory ones so that no deadline is missed.
Documents and evidence to assemble
A strong response depends on having the right documents before an incident and creating the right ones during it.
- Before: an incident response plan with named decision-makers, a contacts list including insurers and advisers, the cyber policy, data maps, supplier contracts with security and notification clauses, and evidence of testing such as tabletop exercise reports and penetration test results.
- During: a decision log, privileged forensic reports, copies of attacker communications, regulator notifications and correspondence, and a single approved chronology.
- After: a remediation plan with owners and dates, board minutes, updated risk assessments and records showing that recommendations were implemented.
In October 2025 the ICO fined Capita £14 million after an attack in which, according to the regulator, a high-priority alert was raised within minutes but the affected device was not quarantined for 58 hours against a one-hour target. Monitoring is only as good as the response behind it. Test the human steps, not just the technology.
Risks and common mistakes
Commissioning forensic reports without protecting privilege
A forensic report commissioned directly by the IT team for operational purposes is unlikely to be privileged, and may later be disclosable to claimants and regulators. Where litigation is reasonably in contemplation, lawyers should commission the investigation for the dominant purpose of that litigation, with separate operational remediation reporting. Privilege is never guaranteed and can be lost by wide circulation, so control distribution and avoid speculative conclusions in emails. Our note on legal professional privilege explains the tests.
Missing contractual notice deadlines
Many commercial contracts, especially in financial services, outsourcing and SaaS, require notice of a security incident within 24 to 72 hours, sometimes from the moment of suspicion. Missing them can be a breach in itself, triggering termination rights or liability that the underlying incident would not. Pull the key contracts on day one and calendar every deadline; data breach lawyers London firms rely on can triage a contract portfolio quickly. When drafting contracts, negotiate realistic notice triggers and limit the information you must provide before facts are confirmed.
Assuming the supplier's breach is the supplier's problem
Many of the largest incidents begin at a supplier: a managed service provider, payroll bureau or file-transfer tool. If you are the controller, you still have to assess and report the breach to the regulator and to individuals, often on limited information from the supplier. Make sure processor contracts require prompt notice, cooperation and access to forensic findings, and that your plan covers supplier incidents specifically. The proposed regime for managed service providers will add regulatory pressure but will not shift your duties.
Saying too much, too soon
Early public statements that no data was taken, or that the attack has been contained, are frequently overtaken by forensic findings. Inaccurate statements damage credibility with the regulator, can amount to misleading the market and become evidence in claims. Say what you know, say what you are doing, and commit to updates. Coordinate legal, communications and investor relations so the same facts appear in every channel.
Neglecting the claims that follow
Large breaches attract claims from individuals for distress and loss, often organised by claimant firms through online sign-ups. The Supreme Court's decision in Lloyd v Google [2021] UKSC 50 made opt-out representative damages claims harder, but group claims by named claimants continue. Business customers may also claim for disruption. Preserve evidence, notify insurers of potential claims, and keep a consistent account of events from the outset. Our commercial litigation team defends these claims.
Building resilience before an incident
The best breach response starts months earlier. Regulators assess what security was appropriate given the risk, the state of the art and the cost of implementation, and they look closely at whether known weaknesses were fixed. Data breach lawyers London boards involve in preparation focus on the decisions and evidence that will matter if the worst happens.
Technical baseline
The National Cyber Security Centre publishes guidance that regulators treat as a benchmark of reasonable practice. Cyber Essentials certification is a government-backed baseline and is required for some public contracts. Neither is a legal safe harbour, but failing to meet widely accepted controls such as multi-factor authentication, patching and privileged-access management is difficult to defend after a breach.
Governance and insurance
Directors owe duties to promote the success of the company and to exercise reasonable care, skill and diligence. Cyber risk should appear on the risk register with a named owner, regular reporting and a budget. Review cyber insurance annually against your actual exposure, including business interruption, regulatory investigation costs and third-party claims, and check exclusions for state-sponsored attacks and unpatched vulnerabilities.
Plans that work under pressure
An incident plan should fit on a few pages, name decision-makers and deputies, and set out who calls the lawyers, the insurer and the regulator. Keep an offline copy, because the plan is useless if it sits on an encrypted server. Run at least one tabletop exercise a year that includes legal and communications decisions, not just technical recovery, and file the lessons learned with the board.
Cross-border incidents: the EU, Bangladesh, the Gulf and Asia
Most significant incidents cross borders: the attacker is abroad, the data sits in several jurisdictions and the affected people live in many countries. Data breach lawyers London groups instruct need to coordinate notifications that run to different clocks.
In the EU, the GDPR's 72-hour rule mirrors the UK's, but each member state regulator may need notice where the UK business has no EU main establishment. NIS2 and, for financial entities, the Digital Operational Resilience Act impose their own reporting regimes on businesses operating in the EU.
Bangladesh overhauled its cyber security legislation by ordinance in 2025 and introduced a personal data protection ordinance later that year. UK groups with Bangladeshi operations, outsourced service centres or garment suppliers should check whether an incident in one country triggers duties in the other. TRW & Co's offices in Dhaka, Chattogram and Sylhet allow us to coordinate both sides quickly, and our UK-Bangladesh practice brings the work together.
The UAE, Singapore and China each have cyber security and data laws with separate reporting duties, and China's rules on exporting data can restrict what forensic material may leave the country. We work with local counsel where foreign law governs and keep a single, consistent narrative across jurisdictions.
How TRW & Co helps
We act as data breach lawyers London businesses can call before, during and after an incident. Our role is legal: we coordinate technical, insurance and communications specialists rather than replacing them.
Incident response
Privileged incident management from the first call, including reportability assessments, regulator and individual notifications, and coordination with forensic firms, insurers and public relations advisers.
Readiness and governance
Incident response plans, board briefings and tabletop exercises built around real legal decisions. We test whether your plan works when the general counsel is unreachable on a Sunday.
Contracts and supply chain
Security schedules, breach notice clauses, liability caps and audit rights in outsourcing, cloud and technology contracts, aligned with your actual risk.
Regulatory engagement
Handling regulator inquiries, information notices and investigations after an incident, and preparing for the proposed regime under the Cyber Security and Resilience Bill.
Disputes and recovery
Injunctions against persons unknown to restrain use of stolen data, claims against suppliers, defence of individual and group claims, and insurance coverage disputes. Where advocacy in the higher courts is required, we instruct specialist counsel.
Data protection foundations
The compliance work that reduces breach impact, from data minimisation and retention to processor terms, delivered with our data protection team.
To discuss a live incident or preparation work, contact our London office at info@trw.co or on +880 1779 127165, or see all our practices.
Checklist for decision-makers
Ask these questions now, before an incident tests the answers. If several produce a pause, data breach lawyers London boards trust can help close the gaps.
- Do we have a current incident response plan that names who decides on notifications and ransom demands?
- Have we rehearsed it in the last twelve months, including a scenario where a key supplier is breached?
- Do we know which regulators, insurers and counterparties we must notify, and how fast?
- Are our advisers pre-agreed under the insurance policy, so no time is lost on day one?
- Can we identify where our personal and critical data is held, including with suppliers?
- Do our key supplier contracts give us prompt notice, cooperation and forensic access?
- Are known vulnerabilities from penetration tests tracked to closure and reported to the board?
- Will we fall within the Cyber Security and Resilience Bill as a managed service provider, data centre or potential critical supplier?
- Do we have a sanctions screening process ready for any extortion scenario?
- Is there a single owner for external communications during an incident?
Cyber resilience is now a legal duty as much as a technical one. The organisations that respond well are those that made the hard decisions in advance and wrote them down.
Frequently asked questions
01What should we do in the first hour after discovering a breach?
Contain the incident without destroying evidence, convene your incident team and call your lawyers and insurer. Lawyers should retain forensic investigators so that their work has the best chance of being privileged. Start a decision log immediately, recording what you know, when you learned it and who decided what. Do not contact the attacker, issue public statements or delete anything until you have advice, because each of those steps can create legal exposure that is hard to undo.
02When does the 72-hour deadline start?
It starts when the controller becomes aware of a personal data breach, meaning it has a reasonable degree of certainty that a security incident has compromised personal data. A short initial investigation is allowed, but organisations should not delay awareness by avoiding enquiry. If you cannot provide all the information within 72 hours, you can report in phases, explaining what is still being investigated. Record the timeline carefully, because the regulator will test it.
03Is it illegal to pay a ransom in the UK?
Paying a ransom is not, in itself, generally a criminal offence for private businesses, but a payment can be unlawful if it reaches a sanctioned person or funds terrorism, and directors must consider their duties to the company. The government has announced plans to ban payments by the public sector and critical national infrastructure operators and to require reporting by others. Payment does not remove notification duties and does not guarantee data deletion. Take legal advice before any engagement.
04Will the Cyber Security and Resilience Bill apply to us?
It may if you provide managed IT services to other businesses, operate a data centre above the proposed thresholds, or supply goods or services to an essential service on which it depends, in which case a regulator could designate you as a critical supplier. Existing operators of essential services and digital service providers will face tighter reporting deadlines and higher penalties. Much of the detail will be set in secondary legislation after the Bill becomes law, so monitor guidance from your likely regulator.
05Can we stop criminals publishing our stolen data?
The High Court can grant injunctions against persons unknown to restrain the use or publication of confidential information, and such orders can help persuade hosting providers and platforms to remove leaked material. An injunction will not stop a determined criminal group, but it can limit onward circulation by legitimate parties and supports takedown requests. Applications are usually made urgently, sometimes without notice, and need careful evidence.
06Can individuals sue us after a data breach?
Yes. Affected people can claim compensation for financial loss and distress under the UK GDPR and the Data Protection Act 2018, and may also bring claims in misuse of private information or breach of confidence. Courts have been sceptical of trivial claims and opt-out representative actions are harder after Lloyd v Google, but group claims by named individuals continue. A prompt, transparent response and evidence of reasonable security are the best defences.
07Do we need to tell our customers if a supplier is breached?
If the supplier processes personal data for you, you are usually the controller and must assess the breach and notify the regulator and individuals where the thresholds are met. Your contracts with business customers may also require notice of incidents affecting their data or services. Ask the supplier for facts in writing, record what you are told, and do not wait for its investigation to finish before making your own decisions.
Sources and official materials
- Cyber Security and Resilience (Network and Information Systems) Bill — Bill progress and text in Parliament
- Network and Information Systems Regulations 2018 — Current UK NIS regime
- Computer Misuse Act 1990 — Criminal offences for unauthorised access
- ICO: Report a breach — Personal data breach reporting
- ICO enforcement: Capita plc (October 2025) — £14 million penalty after a cyber attack
- National Cyber Security Centre — UK technical authority and incident guidance
- Cyber Essentials overview (NCSC) — Government-backed baseline certification
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.