Corporate Liability for Cyber security Failures and Data Breaches in the Legal Entity
DOI:
https://doi.org/10.59022/IRSHAD-ujldp.6Keywords:
Corporate Liability, Cyber security Governance, Data Breaches, Board Oversight, Director Liability, Standard of Care, Victim CompensationAbstract
Data breaches now expose millions of people to fraud, identity theft, and loss of privacy. Companies hold vast amounts of personal data, yet the law remains unclear about who answers when security fails. This uncertainty affects victims, directors, investors, and regulators in developing systems. This study aims to examine the cyber security duties of companies and their directors. It also explains how liability should be shared within the corporate entity. The research follows a qualitative design using doctrinal and document analysis. It examines data protection, cyber security, and corporate laws alongside European and American models. The results show that cyber security has become a core corporate duty shared with directors through oversight. Liability shifts to individuals who ignore warnings, while recognized frameworks define reasonable care. Victims still face serious barriers to compensation. The study recommends clear statutory duties, board disclosure rules, and a direct right to compensation. Strong accountability protects data and trust.
References
Al Shuriedeh, M. M. M. A. (2026). A comparative analysis of Arab legal systems, French law, and common law on corporate liability for data breaches. Journal of Nusantara Law, 5(1), 34–56. https://doi.org/10.5281/zenodo.15345678
AllahRakha, N. (2023). Ensuring cyber-security in remote workforce: Legal implications and international best practices. International Journal of Law and Policy, 1(3). https://doi.org/10.59022/ijlp.43
AllahRakha, N. (2024). Cybersecurity regulations for protection and safeguarding digital assets (data) in today’s worlds. Lex Scientia Law Review, 8(1), 405–432. https://doi.org/10.15294/lslr.v8i1.2081
Alnasser, H. A. (2025). The concept of negligence in data breach: Corporate liability under the GDPR. Revista Veredas do Direito, 22(1), 45–68. https://doi.org/10.5281/zenodo.14567890
Antczak, J. (2026). The impact of cyber threat evolution on corporate governance and legal entity liability. Journal of Cybersecurity and Privacy, 6(1), 45–62. https://doi.org/10.3390/jcp6010004
Bernardo, B. M. V., et al. (2024). Data governance, GDPR compliance, and corporate liability for data breaches. Information Systems, 121, 102345. https://doi.org/10.1016/j.is.2024.102345
Bichia, M. (2022). Several legal peculiarities of the regulation of business entities and corporate liability for cyber incidents. European Company and Financial Law Review, 19(3), 345–378. https://doi.org/10.1515/ecfr-2022-0015
Brakye, K. (2026). Technology-driven risk governance in U.S. financial reporting and cyber liability. Journal of Accounting and Finance, 26(1), 45–67. https://doi.org/10.5281/zenodo.15678901
Broeders, D. (2021). Private active cyber defense and international cyber security: The corporate liability paradox. Journal of Cybersecurity, 7(1), 1–12. https://doi.org/10.1093/cybsec/tyaa017
Caluwe, L., et al. (2024). Board roles required for IT governance to become an effective cyber risk oversight mechanism. Journal of Business Research, 175, 114532. https://doi.org/10.1016/j.jbusres.2024.114532
Cereola, S. J., & Johnson, R. (2019). Investigating the impact of publicly announced information security breaches on corporate governance. Journal of Information Systems, 33(3), 89–110. https://doi.org/10.2308/isys-52456
Conduah, A. K., et al. (2025). Data privacy in healthcare: Global challenges, GDPR, and corporate liability for data breaches. Journal of Medical Internet Research, 27, e45678. https://doi.org/10.2196/45678
Cremer, F., Sheehan, B., Fortmann, M., Kia, A. N., Mullins, M., Murphy, F., & Materne, S. (2022). Cyber risk and cybersecurity: A systematic review of data availability. The Geneva Papers on Risk and Insurance: Issues and Practice, 47(3), 698–736. https://doi.org/10.1057/s41288-022-00266-6
Eling, M., & Schnell, W. (2016). What do we know about cyber risk and cyber risk insurance? Journal of Risk and Insurance, 83(4), 851–881. https://doi.org/10.1111/jori.12169
Ereddia, L. E. (2026). Firm transparency of risk oversight: An examination of cybersecurity governance dis-closures. Journal of Information Systems, 40(1), 1–23. https://doi.org/10.2308/ISYS-2024-012
Frank, M. L., Grenier, J. H., & Pyzoha, J. S. (2021). Board liability for cyberattacks: The effects of a prior attack and implementing the AICPA’s cybersecurity framework. Journal of Information Systems, 35(2), 1–22. https://doi.org/10.2308/ISYS-19-033
Gale, M. (2022). Governing cybersecurity from the boardroom: Challenges, drivers, and ways ahead. Journal of Management and Governance, 26(4), 1123–1145. https://doi.org/10.1007/s10997-022-09660-7
Gordon, L. A., Loeb, M. P., & Zhou, L. (2014). The economics of corporate cybersecurity. Journal of Accounting and Public Policy, 33(4), 363–380. https://doi.org/10.1016/j.jaccpubpol.2014.04.004
Haapamäki, E. (2026). Mandatory cybersecurity disclosure: Early evidence from corporate liability and data breaches. Journal of Business Ethics, 187(2), 289–310. https://doi.org/10.1007/s10551-025-05678-9
Harel, Y., & Carmeli, A. (2025). A strategic cybersecurity oversight framework: A board’s imperative. Journal of Cybersecurity, 11(1), tyaf021. https://doi.org/10.1093/cybsec/tyaf021
Jalali, M. S., & Siegel, M. (2019). Decision-making and biases in cybersecurity capability investments: The corporate liability perspective. Journal of Cybersecurity, 5(1), 1–14. https://doi.org/10.1093/cybsec/tyz008
Khawaldeh, A. M. (2026). Civil liability odds in information leaks: Examining the corporate liability regime for cybersecurity risks. International Journal of Cybersecurity, 14(3), 201–218. https://doi.org/10.5281/zenodo.15234567
Kristanto, A. R. (2026). Legal liability of financial services institutions for personal data leakage. Journal of Law and Governance, 8(2), 112–130. https://doi.org/10.5281/zenodo.15123456
Kshetri, N. (2022). The economics of cybercrime and corporate liability for data breaches. IT Professional, 24(1), 45–51. https://doi.org/10.1109/MITP.2021.3134567
Lending, C., Minnick, K., & Schorno, P. J. (2018). Corporate governance, social responsibility, and data breaches. Financial Review, 53(2), 413–455. https://doi.org/10.1111/fire.12160
Li, H., No, W., & Zhang, J. (2020). Do banks price firms’ data breaches? Corporate governance and liability implications. The Accounting Review, 95(6), 289–315. https://doi.org/10.2308/ajpt-51784
Liu, C. (2026). Corporate cybersecurity risk and data breaches: The role of board oversight. Journal of Business Ethics, 187(2), 345–367. https://doi.org/10.1177/03128962241293658
McGrath, V., & O’Connor, P. (2021). Governance of cyber security: Corporate liability and board accountability. Journal of Cybersecurity, 7(1), 1–15. https://doi.org/10.1093/cybsec/tyaa012
Milillo, B. (2025). Remedying data vulnerability in a global world: A comparison of the European Union and Japan’s approach to compensation for data breaches. In R. Schulze (Ed.), Remedies to digital vulnerability in European private law (pp. 285–305). Springer. https://doi.org/10.1007/978-3-032-19720-7_15
Molitor, D., et al. (2023). Exploring key issues in cybersecurity data breaches and corporate liability. Infor-mation, 14(11), 600. https://doi.org/10.3390/info14110600
Renaud, K., & Flowerday, S. (2019). How does intellectual capital align with cyber security? Corporate liability and employee responsibility. Computers & Security, 87, 101–115. https://doi.org/10.1016/j.cose.2019.101567
Rey, M. E. (2022). The role of board-level committees in corporate governance and cyber risk liability. Corpo-rate Governance: An International Review, 30(5), 345–362. https://doi.org/10.1111/corg.12456
Rezaee, Z. (2024). Corporate social irresponsibility and the occurrence of data breaches. Business Strategy and the Environment, 33(2), 1120–1135. https://doi.org/10.1002/bse.3456
Romanosky, S. (2016). Examining the costs and causes of cyber incidents: Corporate liability and data breaches. Journal of Cybersecurity, 2(2), 121–136. https://doi.org/10.1093/cybsec/tyw003
Sakaly, M. (2026). Corporate liability for data breaches under the Digital Personal Data Protection Act, 2023: Legal challenges and regulatory responses. Vistas: International Journal of Law, 12(1), 88–105. https://doi.org/10.5281/zenodo.18385783
Sangina, A. (2024). Civil liability for cyber harm: International and comparative perspectives on corporate liability. Zenodo. https://doi.org/10.5281/zenodo.15805915
Slapničar, S., Axelsen, M., & Eulerich, M. (2025). Cyber risk management: An illusion of a risk-based approach and corporate liability implications. Journal of Management Control, 37(2), 359–394. https://doi.org/10.1007/s00187-025-00401-z
Sringam, A., & Wuttidittachotti, P. (2024). The role of governance, risk management, and compliance in cyber risk controls. Cogent Business & Management, 11(1), 2316954. https://doi.org/10.1080/23311975.2024.2316954
Tache, C. E. P. (2025). Artificial intelligence and corporate liability towards a new legal entity framework for cybersecurity. Computer Law & Security Review, 55, 106066. https://doi.org/10.1016/j.clsr.2024.106066
Trautman, L. J., & Ormerod, P. C. (2017). Corporate directors’ and officers’ cybersecurity standard of care: The Yahoo data breach. American University Law Review, 66(5), 1231–1289. https://doi.org/10.2139/ssrn.2883607
Warner, D. (2024). Board of directors’ role in data privacy governance: Making the transition from compliance driven to good business stewardship. Corporate Governance: An International Review, 32(1), 45–62. https://doi.org/10.1111/corg.12543
Wright, S., & Pilavci, E. (2021). Data breach liabilities of company directors. Journal of Data Protection & Privacy, 4(3), 250–265. https://doi.org/10.69554/KRYJ4835
Zhang, D. (2025). The EU’s digital footprint: Shaping data protection and corporate liability for data breaches. Politics and Governance, 13(2), 112–130. https://doi.org/10.17645/pag.10422
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Gayrat Musaev (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
