Cyber Security and Cyber Crime

As cyber threats continue to proliferate, having a tailored cyber security strategy in place is now a commercial priority. At DMH Stallard we help businesses devise commercial strategies and security policies that help minimise the risks to the business. This can be a long-term process, including educating and training staff so that there is a high level of awareness across the business about the risk of cyber threats. It also involves advising on how a business interacts with its customers and clients and what it should do when entering into binding commercial agreements with third parties.

A key part of any cyber security strategy will be a cyber or information security policy that embeds cyber security best practice across your organisation. All employees must adhere to the policy and proactively act in accordance with its requirements.

The goal of any effective cyber security strategy is to reduce the risk that your business will be attacked in the first place. It’s also to ensure that if an attack does occur you have the tools available to deal with it in a way that minimises the financial and reputational impact.

Yes. In many respects the implementation of cyber security measures is the technical way you ensure compliance with the UK GDPR regime. At DMH Stallard we work with clients to ensure their cyber security and data protection systems work in tandem with GDPR requirements. We’ll also ensure your approach is a proportionate response to potential cyber attacks and to your organisation’s specific obligations under UK GDPR.

Remember not all GDPR regulations will apply to your business. Do you actually handle personal information for example? We can assist with conducting internal audits to establish your GDPR obligations and identify potential cyber threats. We can then advise on and draft policies and procedures to implement appropriate cyber and data protection policies.

In the absence of an effective hosting agreement, it’s sometimes complicated to establish the liability of hosting providers, whether the hosting is provided on shared or dedicated servers or is carried out under a co-location contract.  Difficulties arise when there are security breaches or unacceptably low service levels. Often it will come down to the terms of the relevant hosting agreement and what the business agreed to under those terms. In our experience these will often limit the host’s liability in line with its standard terms and conditions and therefore we would need to work with you to see what protection there may be under the agreement terms and if there is none or little, how else we could assist you to improve your position.

We can advise you on:

• Any proposed hosting agreement for your business, assessing whether the provisions being offered are adequate for your business and what is in place relating to the service levels and data protection obligations

• Liability for security breaches including hosting of indecent or defamatory content or material which infringes a third party’s intellectual property. It’s crucial to include provisions that deal with the host’s liability in circumstances where your site security is breached because the host’s cyber security is insufficiently robust

Our dispute resolution solicitors can provide you with guidance on the most effective way to deal with a dispute to minimise any economic or reputational damage to your business, including advice on the various methods of alternative dispute resolution (ADR).

Cyber attacks and data breaches are now a major concern for businesses. If not handled correctly the economic and reputational damage to an organisation can be significant. There is also the risk of substantial regulatory fines. When you do suffer a data breach you should be able to rely on the protocols you have in place to respond appropriately. A large part of our cyber and data security work involves helping businesses lay the groundwork for a data breach response. There are a number of things to consider in the event of a breach:

• First, make your response measured and proportionate. Data breaches are not uncommon. Government statistics covering 2023 indicate that 32% of small businesses, 59% of medium businesses and 69% of large businesses experienced breaches or attacks in the preceding 12 months. This can come at a huge cost and major disruption to the business.

• Not every breach will result in formal action being taken against you by the Information Commissioner’s Office (ICO), and not every breach has to be reported to the ICO. You only have to notify the ICO of a breach if it is likely to result in a risk to the rights and freedoms of individuals. So, a lot of the actions you take when you become aware of a breach are concerned with assessing the risk the breach poses to individuals, managing that risk and deciding whether you need to report the breach or not.

• Under UK GDPR rules if the breach is one that is reportable you must report it to the ICO within 72 hours. You should immediately start to gather information about the breach, recording what happened, who was involved and what actions you’ve taken.

• Try to minimise the impact of the breach. Can you recover the data? Can systems be shut down or access limited? What steps can you take to protect individuals who will be affected by the data breach?

Assess the risk of harm to those affected bearing in mind issues such as safeguarding, identity theft and personal distress that may be caused by the leaking of personal data. Remember a data breach might carry a low level of risk, but some breaches may carry very high risk on individuals. Where there is a higher level of risk you should proactively inform individuals of what’s happened and provide information to those individuals about the steps they can take to protect themselves.

Reacting to a breach in the correct way is crucial. We can offer advice where necessary to ensure you meet your obligations under UK GDPR, liaise with the ICO on your behalf and take the necessary steps to inform those individuals who have been affected.