A ransomware attack turns an ordinary business day into a crisis: systems locked, data stolen and a demand for payment. Amid the technical response, it is easy to overlook that ransomware also triggers legal obligations, often on a tight clock. Knowing those duties in advance is the difference between a controlled response and a second crisis with the regulator. This guide sets out what the law requires when ransomware strikes.
Ransomware is usually a personal data breach
Most ransomware incidents involve personal data, whether because it is encrypted and unavailable or because attackers copy it before locking your systems. Under the GDPR that is a personal data breach affecting the availability, and often the confidentiality, of data. This engages the breach-notification duties, which run on a short timeline and do not wait for the technical clean-up to finish.
The 72-hour notification duty
If the breach is likely to result in a risk to individuals, you must notify the supervisory authority, in Sweden the Swedish Authority for Privacy Protection (IMY), without undue delay and within 72 hours of becoming aware of it. Where the risk to individuals is high, for example if sensitive data has been exfiltrated, you must also inform the affected people. You must document the breach either way, even if you decide notification is not required.
Sector rules: NIS2 and beyond
Data protection is not the only regime in play. Businesses classified as essential or important entities under the NIS2 framework, and financial firms under sector rules, face their own incident-reporting obligations to sector regulators, often with even tighter initial deadlines. A ransomware incident can therefore trigger several parallel reporting duties, which is why mapping them before an attack matters.
Practical example: an exfiltration and encryption attack
A mid-sized company discovers its files encrypted and receives a demand. Investigation shows attackers also copied a database of customer details. This is a reportable breach: the clock to notify IMY starts when the company becomes aware, and because sensitive personal data left the business, affected customers likely need to be told too. Deciding these questions in the moment is far harder without a plan.
Vanliga misstag som företag gör
Frequent errors include treating ransomware as purely an IT problem and involving legal too late, missing the 72-hour window while waiting for full forensic certainty, failing to document the decision-making, and rushing to pay the ransom without considering the legal and practical implications. Paying does not discharge your notification duties and can raise separate legal risks, including around sanctions.
Rekommenderade åtgärder
Prepare an incident-response plan that names who decides what, and includes legal and breach-notification steps alongside the technical ones. Know in advance which regulators you may need to notify and on what timeline. Keep secure, tested backups so recovery does not depend on paying. If an attack happens, act on the notification clock promptly, document every decision, and take legal advice before engaging with attackers or paying.
Vanliga frågor
Do we have to report a ransomware attack?
If personal data is affected and there is a risk to individuals, you must notify the supervisory authority (IMY) within 72 hours, and tell affected people where the risk is high. Sector rules such as NIS2 may add further reporting duties.
Is it illegal to pay the ransom?
Paying is not automatically illegal, but it is generally discouraged, does not remove your reporting duties, and can create separate risks, including breaching sanctions if the recipient is a sanctioned entity. Take advice before paying.
When does the 72-hour clock start?
It starts when you become aware of the breach with reasonable certainty that personal data has been affected, not when the full investigation is complete. Waiting for total certainty is a common way to miss the deadline.
Slutsats
Ransomware is a legal event as much as a technical one, with reporting duties that start fast and run in parallel. Preparing before an attack lets you meet those duties calmly instead of scrambling. Lawgent helps businesses build incident-response plans, map their notification obligations and navigate the legal decisions in the middle of an attack. Contact us to prepare before you need to.
