Is the DPO Responsible for a Cyber Attack?

In this episode of Legal Break, Giulio Coraggio, location head of the Italian Intellectual Property & Technology Law group at the law firm DLA Piper and the journalist Antonio Ravenna explain an important Italian court decision about DPO liability, GDPR, and cyber fraud.

A company lost €390,000 in a Business Email Compromise (BEC) attack: criminals sent fake payment instructions and the money went to the wrong bank account. The company tried to blame its external DPO, but the Court of Florence (Decision No. 3034 of 29 May 2026) said no.

Giulio and Antonio explain, in clear and simple words, why the DPO’s job under the GDPR is to advise and monitor, not to make security decisions, and why the duty to put real security measures in place stays with the company. They also share practical lessons: why good documentation is the DPO’s best defense, why ignoring the DPO’s advice can create liability for the company, and why naming a DPO is not a replacement for real cybersecurity. 

Send us Fan Mail

Episode Transcript

SPEAKER_01 (00:00):
Welcome everyone.

(00:00):
I'm Giulio Coraggio, atechnology and data lawyer at
the global law firm Delay Piper.

SPEAKER_00 (00:05):
And I'm Antonio Ravenna, a journalist.

SPEAKER_01 (00:07):
We are here to discuss a very interesting case
relating to the liability ofdata protection officer.

SPEAKER_00 (00:13):
And we're gonna make it during the time of a coffee
break.
Hi Giulio.
An Italian court just ruled on acase involving a DPO and cyber
fraud worth nearly 400,000euros.
What happened?

SPEAKER_01 (00:30):
Well, it's a really interesting case.
It relates to a company in theutility sector.
Basically, one of the employeesof this company received an
email that um seemed to belegitimate.
It was coming from an emailaddress that was from a customer
of the company, basicallyrequiring to change the IBAN

(00:52):
number, the bank accountdetails, to which a payment had
to be performed.
The officer in charge justexecuted the request, but
unfortunately, the IBAN numberwas not of uh the customer or
the supplier that was meant toreceive the payment, but was um
of uh the fraudsters, andtherefore 390,000 euros were

(01:17):
kind of uh diverted to adifferent bank account, and all
of a sudden they disappeared.
What is interesting here is uhthat um following this accident,
the victim of the fraud decidedto bring a claim against um the
firm of the DPO, justchallenging that um this event

(01:38):
had occurred because of a sortof a lack of service by the DPO.

SPEAKER_00 (01:43):
So, at the heart of this ruling is a fundamental
question.
Actually, what does the GDPR sayabout what a DPO is supposed to
do?

SPEAKER_01 (01:50):
It's interesting because it seems to say, in the
view of the claimant, that uhthe DPO is in charge of ensuring
privacy compliance of thecompany, is uh the kind of uh
main actor of the privacycompliance of the company, while
the scenario is quite differentunder the GDPR.

(02:12):
It is true that in a few casesthe DPO does more than what is
required under the GDPR, but umthe GDPR provides the role of
the DPO as a sort of auditor ofthe data protection compliance
of the company.
So it doesn't take decisions, itgives um recommendations on what

(02:35):
the company shall do in order toensure compliance.
In practice, it doesn't meanthat the DPO is uh a
representative of the datacontroller.
The DPO actually, also in caseof disputes, cannot represent
the company, it's a third party,even when it's an employee of

(02:55):
the company, because it's a mereadvisor, it's a mere auditor, it
needs to flag a potential lackof compliance.
And this is exactly whathappened in this case.
The DPO had flagged a lack of uhsecurity measures and um
reported actually in twoinstances that uh the employees
required a specific training onthis kind of frauds, and uh and

(03:18):
then the company decided not todo not to run this kind of um
trainings for the very frequentreason for cost-related matters,
and then it suffered the cyberattack.

SPEAKER_00 (03:30):
And so, Julio, what are the practical takeaways for
DPOs and companies?

SPEAKER_01 (03:34):
From the perspective of the DPO, the golden rule is
that you need to documenteverything you do because then
otherwise you could be blamedfor what um you weren't able to
document, you were not able toprove, and therefore the
accountability principle that isone of the backbones of the GDPR
applies even to the conduct ofthe DPO.

(03:55):
Not only towards regulators,towards the garante and the
other data protectionauthorities, but also internally
in order to protect the DPO uhin relation to potential claims
against him.
The golden rule for datacontrollers is that you cannot
blame the DPO for your lack ofcompliance.

(04:15):
The DPO is a mere auditor, it'sa supervisor of the compliance,
but then if the measures are notput on the ground by the
company, the liability is stillon the data controller, on the
company that was supposed to dothe activities which were not
done.
Then there is a gray area whenthe DPO doesn't flag some lack

(04:38):
of compliance.
But again, even in that case,there is a risk that the data
protection authorities are gonnablame the uh data controller,
the entity that was uh meant tocomply, that then can allocate
part of the liability on the DPOif there was in practice a lack
of service on his eye.

SPEAKER_00 (04:56):
So, document everything and don't confuse
advice with responsibility.

SPEAKER_01 (05:00):
Absolutely, Antonia.

SPEAKER_00 (05:01):
Thank you very much, Giulio.
Thank you everyone, arrived.