Corporate liability for cyber incidents

1. Civil liability (BGB – German Civil Code, tort law, contractual obligations)

Companies can be liable if:

• malware is passed on due to inadequate IT security measures;
• they breach the customary duty of care (e.g. no firewalls, no patches, no virus scanners);
• a contractual partner suffers damage (e.g. through infected e-mails or contaminated software deliveries).

Example:
A law firm unknowingly sends a Trojan to a client.
The client suffers data loss.
The law firm is liable if it has not taken standard protective measures (e.g. lack of employee training, outdated software).

2. Liability of management / the executive board

Under § 43 GmbHG or § 93 AktG, managing directors/board members must exercise "the diligence of a prudent businessperson".

• Management must ensure adequate IT security measures (e.g. ISO 27001, BSI-Grundschutz – the German Federal Office for Information Security's baseline protection).
• Personal liability is possible if protective measures were not taken through gross negligence or intentionally.
• In the event of damage: internal liability towards the company or external liability towards third parties.

3. Liability towards customers / contractual partners

• Anyone who passes malware on to customers may be in breach of ancillary contractual obligations (§280 BGB).
• This can be interpreted as defective performance or a breach of duty.
• Claims for damages are possible (e.g. business interruption, data loss, IT recovery costs).

4. Public-law liability (e.g. DSGVO (GDPR))

If personal data is compromised by malware:

• Obligation to notify the supervisory authority within 72 hours (Art. 33 DSGVO).
• Possible fines (up to 20 Mio. € or 4 % of annual turnover, Art. 83 DSGVO).
• Liability towards data subjects for non-material damage (Art. 82 DSGVO).

5. Criminal law risks

• In cases of gross negligence, a corporate penalty (Verbandsstrafe) can be imposed under the OWiG (German Administrative Offences Act).
• In serious cases, e.g. where IT security is deliberately disregarded, investigations against managing directors are conceivable.

6. Obligations for companies (duties of prevention)

As a rule, a company must:

• use virus protection and firewalls
• carry out regular security updates
• organise IT security training for employees
• implement access controls and rights management
• carry out backups
• have an emergency plan (incident response) in place

Companies that fail to meet these obligations act negligently and can be held liable.

this text was read on online pages and summarised with AI (Copilot/ChatGPT)