A recent U.K. court ruling means that organisations can be held liable for breaches of personal data, even if the act was malicious and the company could demonstrate that it had suitable controls, policies and procedures in place to protect that information.



