Director Liability for Cyber Incidents in the UK

This article is general information about UK law as of November 2026. It is not legal advice. Take advice from a qualified lawyer on your own circumstances.

Who is liable for what: a quick map

Several regimes overlap. The table shows who each mainly targets and its maximum penalty.

Directors’ duties under the Companies Act 2006

The general duties of directors are set out in sections 171 to 177 of the Companies Act 2006. Section 170(1) states that these duties “are owed by a director of a company to the company”. That matters: a customer or member of the public affected by a breach cannot normally sue a director for breach of these duties. The company can, and in England and Wales or Northern Ireland a member can bring a derivative claim on the company’s behalf under section 260 for negligence, default, breach of duty or breach of trust by a director.

Two duties are most relevant to cyber risk:

• Section 172, duty to promote the success of the company. A director must act in the way they consider, in good faith, would be most likely to promote the success of the company for the benefit of its members as a whole, having regard to matters including “the likely consequences of any decision in the long term”, the interests of employees, relationships with suppliers and customers, and “the desirability of the company maintaining a reputation for high standards of business conduct”.
• Section 174, duty to exercise reasonable care, skill and diligence. The standard is that of a reasonably diligent person with both the general knowledge, skill and experience reasonably expected of someone in that director’s role, and the knowledge, skill and experience the particular director actually has.

These duties do not mention cyber security. After an incident, the practical question is whether the board took reasonable care over a known business risk: was it informed, did it challenge, did it act, and can it show this? A director with a security background is judged against that higher personal knowledge under section 174(2)(b).

UK GDPR and the Data Protection Act 2018

Under Article 32 of the UK GDPR, both the controller and the processor must implement appropriate technical and organisational measures to ensure “a level of security appropriate to the risk”. Under Article 33, the controller must notify a personal data breach to the regulator “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to people’s rights and freedoms.

Section 157 of the Data Protection Act 2018 sets the maximum fines:

• Higher maximum: £17,500,000 or 4% of the undertaking’s total annual worldwide turnover in the preceding financial year, whichever is higher.
• Standard maximum: £8,700,000 or 2% of that turnover, whichever is higher.

Which cap applies depends on the provision infringed. Under Article 83 of the UK GDPR, breaches of Articles 25 to 39 (including Articles 32 and 33) carry the standard maximum; breaches of the basic principles in Article 5, among others, carry the higher one.

Note the regulator’s new name: on 30 September 2026 the Information Commissioner’s Office formally transitioned to the Information Commission, overseen by a board under governance arrangements introduced by the Data (Use and Access) Act 2025. It is still referred to as the ICO.

Two recent ICO fines, both imposed on companies rather than individual directors, show where the focus lies:

• Capita (15 October 2025): a combined £14m (£8m on Capita plc and £6m on Capita Pension Solutions Limited) after a March 2023 attack in which the personal information of 6.6 million people was stolen.
• Advanced Computer Software Group (27 March 2025): £3.07m (a final penalty of £3,076,320) after an August 2022 ransomware incident. Attackers got in through a customer account without multi-factor authentication (MFA), and the ICO cited gaps in MFA, vulnerability scanning and patch management.

Directors become personally exposed through criminal liability. Section 198 of the Act provides that where an offence under the Act is committed by a company with the consent or connivance of, or is attributable to neglect on the part of, a director, manager, secretary or similar officer, that person “as well as the body corporate, is guilty of the offence”. Separately, Article 82 gives anyone who suffers material or non-material damage from an infringement a right to compensation from the controller or processor.

The NIS Regulations 2018

The Network and Information Systems Regulations 2018 apply to two groups:

• Operators of essential services (OES) in the subsectors listed in Schedule 2 (electricity, oil, gas, air, water, rail and road transport, healthcare, drinking water and digital infrastructure), where thresholds are met or the operator has been designated.
• Relevant digital service providers (RDSPs) offering an online marketplace, online search engine or cloud computing service. The Information Commission is the enforcement authority for RDSPs.

An OES must notify its competent authority of a NIS incident “without undue delay and in any event no later than 72 hours” after becoming aware of it. Under regulation 18, penalties are imposed on the OES or RDSP and must not exceed £1,000,000 for a non-material contravention, £8,500,000 for a material contravention, and £17,000,000 for a material contravention that has or could have created a significant risk to, or impact on, the service.

The Cyber Security and Resilience (Network and Information Systems) Bill would amend these Regulations. As of 11 November 2026 it had not received Royal Assent (it was at consideration of Lords amendments in the Commons); check bills.parliament.uk for its current status.

Financial services: the Senior Managers and Certification Regime

For FSMA-authorised firms, the Senior Managers and Certification Regime (SM&CR) is where personal accountability is most explicit. The FCA describes it as having three parts: the Senior Managers Regime, the Certification Regime and the Conduct Rules.

Sections 66A and 66B of the Financial Services and Markets Act 2000 let the FCA and the PRA respectively take action against a senior manager where the firm breached a relevant requirement, the senior manager was responsible for managing the activity concerned, and the senior manager “did not take such steps as a person in the senior manager’s position could reasonably be expected to take” to avoid the breach.

Firms are penalised too. On 1 October 2018 the FCA fined Tesco Personal Finance plc (Tesco Bank) £16,400,000 for failing to exercise due skill, care and diligence in protecting personal current account holders against a cyber attack in November 2016. The FCA described it as a “largely avoidable incident” that took place over 48 hours and netted the attackers £2.26m.

Director disqualification

Under section 6 of the Company Directors Disqualification Act 1986 (which extends to England, Wales and Scotland), the court must disqualify a person who has been a director of a company that has become insolvent (or been dissolved without becoming insolvent) if their conduct makes them unfit to be concerned in the management of a company. Disqualification lasts from 2 to 15 years.

This applies only after insolvency or dissolution, but a severe incident can contribute to a company failing.

D&O insurance in general terms

Section 232 of the Companies Act 2006 generally makes void any provision that exempts or indemnifies a director against liability for negligence, default, breach of duty or breach of trust. Section 233, however, allows a company to purchase and maintain insurance for its directors against that liability. This is directors’ and officers’ (D&O) insurance.

Policies vary. Questions for your broker:

• Does the policy cover defence costs for regulatory investigations, not only civil claims?
• Is there an exclusion for cyber or data incidents, and does it interact with the company’s separate cyber policy?
• Which fines and penalties, if any, are covered, and does the policy say they are covered only where insurable by law?

What boards can do now

The government’s Cyber Governance Code of Practice, published on 8 April 2025 with the NCSC, is aimed at boards and directors and describes itself as setting out “the most critical governance actions that directors are responsible for”. Its five principles are:

1. Risk management
2. Strategy
3. People
4. Incident planning, response and recovery
5. Assurance and oversight

From a liability point of view, the aim is to be able to show reasonable care. That usually means:

• Cyber risk is a recurring board agenda item, with minutes that record questions asked and decisions made, not just “noted”.
• One named executive owns cyber risk.
• The board has seen and rehearsed the incident response plan, including who decides on the 72 hour notifications under UK GDPR and NIS.
• Known weaknesses (for example an account without MFA, the entry point in the Advanced case) have an owner, a deadline and follow-up.
• Directors are trained enough to challenge what they are told.

How LSCS can help

Our Board Governance of Cybersecurity course is written for directors and senior leaders: 12 hours of training delivered as 1 day in person or 5 days virtual instructor-led, BCS Tech 10 accredited, at £1,900. It covers compliance frameworks, laws and director liabilities, and what directors need to know before, during and after a breach. Contact us for dates. For teams who prepare board reports, our free lesson on management reporting in GRC is a useful start, and we also offer tailored training for organisations.

Frequently asked questions

Can a director be personally fined by the ICO after a data breach?

ICO fines under UK GDPR are normally imposed on the organisation as controller or processor; the Capita and Advanced fines were imposed on the companies. Directors can, however, be personally guilty of an offence under the Data Protection Act 2018 if it was committed with their consent or connivance or through their neglect (section 198).

Which Companies Act duties apply to cyber security?

The most relevant are section 172 (promote the success of the company, considering long-term consequences and reputation) and section 174 (exercise reasonable care, skill and diligence). They are owed to the company, not to customers.

What is the maximum ICO fine for a cyber breach?

Under section 157 of the Data Protection Act 2018 and Article 83 of the UK GDPR, the highest cap is £17,500,000 or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. Breaches of the security and breach notification duties in Articles 32 and 33 fall under the standard maximum of £8,700,000 or 2%; the higher cap applies to provisions such as the basic principles in Article 5.

What is the maximum fine under the NIS Regulations 2018?

£17,000,000 for a material contravention that has or could have created a significant risk to, or impact on, the service. Lower caps of £1,000,000 and £8,500,000 apply to other contraventions.

Does D&O insurance cover cyber incidents?

It depends entirely on the policy wording. Section 233 of the Companies Act 2006 allows companies to insure directors against liability, but you should check exclusions, regulatory investigation cover and how it interacts with any cyber policy with your broker.

References

• UK Parliament (2006). Companies Act 2006, sections 170, 172, 174, 178, 232, 233 and 260. https://www.legislation.gov.uk/ukpga/2006/46/contents
• UK Parliament (2018). Data Protection Act 2018, sections 157 and 198. https://www.legislation.gov.uk/ukpga/2018/12/contents
• legislation.gov.uk (2016, as retained and amended). UK GDPR, Articles 32, 33, 82 and 83. https://www.legislation.gov.uk/eur/2016/679/contents
• UK Government (2018). The Network and Information Systems Regulations 2018 (SI 2018/506), regulations 1, 8, 11, 18 and Schedule 2. https://www.legislation.gov.uk/uksi/2018/506/contents
• UK Parliament (2000). Financial Services and Markets Act 2000, sections 66, 66A and 66B. https://www.legislation.gov.uk/ukpga/2000/8/section/66A
• UK Parliament (1986). Company Directors Disqualification Act 1986, section 6. https://www.legislation.gov.uk/ukpga/1986/46/section/6
• ICO (2025). Capita fined £14m for data breach affecting over 6m people. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/capita-fined-14m-for-data-breach-affecting-over-6m-people/
• ICO (2025). Software provider fined £3m following 2022 ransomware attack. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/
• ICO (2026). ICO welcomes transition to new Information Commission and marks new chapter with Manchester head office opening. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/
• FCA (2018). FCA fines Tesco Bank £16.4m for failures in 2016 cyber attack. https://www.fca.org.uk/news/press-releases/fca-fines-tesco-bank-failures-2016-cyber-attack
• FCA (accessed 2026). Senior Managers and Certification Regime. https://www.fca.org.uk/firms/senior-managers-certification-regime
• DSIT, DCMS and NCSC (2025). Cyber Governance Code of Practice. https://www.gov.uk/government/publications/cyber-governance-code-of-practice
• UK Parliament (2026). Cyber Security and Resilience (Network and Information Systems) Bill (stage checked 11 November 2026). https://bills.parliament.uk/bills/4035