Cybersecurity

For digital businesses, a cyberattack is no longer a question of if but when. Ransomware, data theft, account takeovers and smart contract exploits can halt operations in hours. The legal consequences can be as serious as the technical ones: regulatory sanctions, claims from customers and partners, and lasting damage to reputation.

EU cybersecurity law has grown considerably in recent years:

• NIS2 covers a wide range of essential and important entities.
• DORA sets digital operational resilience requirements for financial entities, including crypto-asset service providers.
• The Cyber Resilience Act introduces security requirements for products with digital elements.
• The GDPR continues to govern personal data breaches.

Each regime has its own rules on risk management, incident reporting and oversight by management. Management bodies can now be held directly accountable for cybersecurity failures.

We help you on two fronts. Before an incident, we build the policies, contracts and governance that these rules require. After an incident, we manage the legal response: notifications, communications, dealings with authorities and claims to recover losses. We work alongside your IT and security teams and your external incident response providers.

How we can help

• NIS2 compliance: scope assessment and registration, risk management measures, supply chain security, and management body training and accountability
• DORA compliance: ICT risk management framework, incident classification and reporting, resilience testing, contracts with ICT third-party providers and the register of information
• Cyber Resilience Act: security-by-design requirements, vulnerability handling, reporting of actively exploited vulnerabilities and conformity documentation for products with digital elements
• Security policies and governance: information security, incident response, business continuity, access control and supplier security policies, aligned across NIS2, DORA, the CRA and the GDPR
• Incident response: legal coordination from the first hours, evidence preservation, and handling of ransom demands, including sanctions risks
• Regulatory notifications: notifications to data protection authorities, CSIRTs and financial supervisors, and communications to affected individuals
• Public communications: press statements and notices to customers, investors and partners, drafted to be accurate without creating additional liability
• Contracts and insurance: security clauses in supplier and customer contracts, allocation of liability, and cyber insurance coverage and claims
• Claims and recovery: actions against providers, auditors and intermediaries responsible for a breach or hack, and recovery of stolen funds (see Litigation & Arbitration)

When an incident happens

A single incident can trigger several notification obligations at once, to different authorities and under different rules. Some deadlines run in hours, not days, and they start while the facts are still unclear. Regulators and customers will read what you say in those first notifications and public statements, and so will judges in any later litigation.

We coordinate the legal response with your technical team and incident responders. We assess the incident under each regime, prepare the notifications, draft public communications and handle follow-up with the authorities. At the same time, we preserve evidence and identify third parties who may be liable, so the path to recovering your losses stays open. The best response is prepared in advance, with a tested incident response plan, ready-made templates and clear roles for everyone involved.

Our approach

Security and legal teams often speak different languages, and incidents are where that gap becomes costly. We understand the technology well enough to work directly with your engineers and translate their findings into legal decisions. We help you invest in cybersecurity in a way that is proportionate to your risks. The aim is to protect both your business and the people who manage it.