What to do in a cyberattack if you have no cyber insurance?

Lack of cyber insurance does not waive any legal obligation, notification deadlines run the same way. Without insurance, it is all the more important to act quickly on the legal front: a late notification risks a regulatory fine, poorly framed communication can constitute an admission of liability, and evidence lost during remediation may deprive you of any recourse against the attacker.

When can an SME or mid-cap be considered in crisis?

A cyber incident becomes a crisis when it disorganises the company and requires strategic trade-offs. This depends on the technical nature of the event, the company's level of preparedness, its dependence on IT systems, the sensitivity of the data involved, and its operational constraints.

Is the crisis cell always the same regardless of the organisation?

No. The composition of the crisis cell depends on the company's size, sector, internal structure and the nature of the attack. The principle, however, remains the same: quickly gather the decision-makers and expertise strictly necessary to lead the response.

Must you always notify the DPA in a cyberattack?

No. A cyberattack does not automatically trigger a DPA notification. It depends on the nature of the incident, whether a personal data breach occurred, and the risk level for affected individuals. The key is to correctly qualify the situation and document the decision made.

What do you risk if you fail to notify the DPA in time?

In case of a notification failure, the DPA can issue a formal notice, a reprimand or a financial penalty of up to €10 million or 2% of global annual turnover. Beyond the administrative sanction, the absence of notification can also be used by a client or partner in litigation to establish fault.

Why file a criminal complaint after a cyberattack?

Filing a complaint can help trigger investigations, support insurance claims and formally record what the company suffered. It must be carefully prepared, as its quality can affect the outcome. Some cyber insurance policies require filing within 72h as a condition of coverage.

When should you call a crisis lawyer during a cyberattack?

As early as possible. A cyber incident can trigger notification obligations with tight deadlines running from the moment you become aware. Evidence can be lost during remediation if nobody has identified what must be preserved. A crisis lawyer does not intervene after the crisis to assess the damage, they intervene during the crisis so that decisions made under pressure are legally defensible.

Fibres optiques lumineuses évoquant une infrastructure réseau en alerte

SME / Mid-cap · Cyber incident in progress?

Cyber crisis management lawyer

The first decisions engage your liability. They are made in the first hours.

Ransomware, phishing, CEO fraud, email compromise, data breach: EMPREINTE Avocats intervenes alongside CEOs, CIOs and CISOs to provide a legal framework under intense pressure.

CEOs / ManagementCIO / CISOLegal departments

ACTIVE INCIDENT

Information to gather before the first call:

—nature of the incident;
—date and time of detection;
—systems, data or clients affected;
—cyber insurance and vendors already engaged;
—actions already taken.

Even if incomplete, these elements allow us to qualify notification obligations, preserve evidence and secure the first decisions.

EMPREINTE Avocats · Annecy · Intervention immédiate

First reflexes

Five decisions to make in the first hours.

In the first hours of a cyber incident, several decisions must be made simultaneously, without full visibility. Some have serious legal consequences if poorly documented or made too late.

Experts analysant des données chiffrées lors d'une réponse à incident

Contain without erasing traces

Isolate compromised systems without deleting logs or evidence. Technical remediation must not erase what will be needed in case of a regulatory review or legal proceedings.

Alert the right people

Management, CIO, CISO, cyber insurer, and crisis lawyer. Each actor has a defined role. The absence of one can block or delay critical decisions.

Identify notification obligations

DPA within 72h if data breach, national cybersecurity authority depending on sector, insurer often within 48h per policy terms, clients or partners per contract. These deadlines start running from the moment you become aware of the event.

Document facts from the start

Timeline, decisions made, internal communications, technical actions. Early documentation protects the company and makes decisions defensible before the regulator, insurer or court.

Do not communicate improvisationally

Any public statement or communication to clients engages the company's liability. Premature or inaccurate communication can constitute an admission of fault or worsen legal exposure.

Our missions

Structured legal support, from the start of the crisis to the aftermath.

Why call a lawyer?

The lawyer limits the secondary consequences of the cyber crisis.

A cyberattack is not just a technical incident. It can cause business interruption, tension with clients and partners, commercial claims, regulatory reviews and lasting reputational damage.

Clear legal reading of the situation

Prioritisation of actions that engage the company's liability

Identification of all applicable obligations

Better coordination between crisis actors

Safer communication and traceability of decisions

Anticipation of the aftermath from the first hours

Why EMPREINTE Avocats?

Not just a lawyer. A crisis lawyer.

In a cyberattack, companies don't just need a lawyer who can identify applicable rules. They need a lawyer who can bring structure, judgment and support in a high-pressure moment for management and teams.

Being supported

Accompanying you in a structured, reassuring way during intense pressure on management and teams. A single point of contact holding the legal thread from start to finish.

Avoiding missteps

Anticipating errors and securing sensitive decisions based on our experience with cyber crises. The most costly mistakes are often made in the first hours, under pressure.

Mobilising the right experts

Directing you towards the technical experts suited to the case (forensics, crisis communication, sector specialists) and coordinating their involvement with the legal strategy.

FAQ

Frequently asked questions

Facing a cyberattack?

Contact us now.

The first hours of a cyber crisis are the most legally decisive. Every hour counts for notification obligations, evidence preservation and the protection of your liability.