The Small Business Cyber Security Guy | Cybersecurity for SMB & Startups

When Ransomware Kills: Should Directors Face Prison for Cyber Negligence?

Listen Later

What happens when business negligence causes serious harm to thousands of people? If a faulty ladder injures someone, directors face prison time. If forty million people have their data stolen due to poor security, they receive a strongly worded letter.

In this provocative first episode of our two-part series, Noel and Mauven examine the shocking disparity between health and safety enforcement and cybersecurity regulation in the UK. We compare the HSE's tough approach (prison sentences, director liability, millions in fines) with the ICO's gentle touch (guidance, occasional fines, zero criminal consequences).

With 40 million voter records compromised at the Electoral Commission resulting in just a formal reprimand, whilst construction directors regularly face 18-month prison sentences for single workplace accidents, we ask the uncomfortable question: why is cybersecurity enforcement essentially performative?

This isn't anti-business rhetoric. This is an evidence-based examination of a broken system that fails to protect either businesses or the public, presented through statistics, case studies, and historical precedent, which demonstrates that personal accountability is effective.

What You'll Learn
The Two Regulators: A Tale of Vastly Different Consequences
  • Why HSE directors face up to 2 years imprisonment, whilst the ICO never imposes criminal penalties
  • How HSE issued 13,424 enforcement notices and 399 prosecutions in 2023-24
  • Why the ICO issued just £2.7 million in total UK fines, whilst EU regulators issued over £1 billion
  • The legal frameworks that create this enforcement gap
    • The Public-Private Accountability Divide
    • Electoral Commission breach: 40 million records compromised, 14 months of hostile state access, consequence: formal reprimand
    • Construction site failures: single injuries lead to prison sentences and director disqualifications
    • Why do government organisations face minimal consequences for security failures
    • The message this sends about who matters and who doesn't
      • Historical Context: How HSE Transformed Workplace Safety
      • 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974
      • How personal criminal liability changed director behaviour overnight
      • The construction industry transformation from dangerous to safety-conscious
      • Evidence that accountability actually works when properly enforced
        • Arguments Against Director Liability (And Why They Fail)
        • "Security is too complex for criminal standards" - why doesn't this hold up
        • "Small businesses can't afford proper security" - HSE already handles proportionate enforcement
        • "Innovation will suffer" - data showing the opposite effect in the safety sector
        • "Current system works fine" - statistics proving it demonstrably doesn't
          • The Current State of Inertia
          • Why ICO enforcement focuses on "guidance and support" over punishment
          • Political pressure keeps cybersecurity consequences minimal
          • Business lobby resistance to accountability measures
          • The broken incentive structure that rewards negligence
            • Key Statistics Referenced

            • HSE Enforcement 2023-24:

              • 13,424 enforcement notices issued
              • 399 prosecutions brought
              • £73.8 million in fines
              • Regular prison sentences (average 12-18 months for serious breaches)

              • ICO Enforcement 2023-24:

                • £2.7 million total fines across all UK GDPR violations
                • Zero prison sentences imposed
                • Zero director disqualifications
                • Focus on "guidance and support" over punishment

                • Electoral Commission Breach:

                  • 40 million UK voter records compromised
                  • The hostile state actor maintained access for 14 months
                  • Basic security failures: poor patching, weak passwords, inadequate monitoring
                  • Consequence: Formal reprimand only

                  • Impact Statistics:

                    • 85% reduction in workplace fatalities since the Health and Safety at Work Act 1974
                    • EU regulators issued over £1 billion in GDPR fines (vs the UK's £2.7 million)
                    • Keymark Construction director: 18 months' prison for fatal fall (2023)
                      • Notable Cases Discussed
                      Health and Safety Enforcement
                      • Keymark Construction (2023): Director sentenced to 18 months imprisonment following fatal fall due to inadequate safety measures
                      • Corporate Manslaughter Act 2007: Multiple organisations convicted when management failures caused death
                        • Cybersecurity Non-Enforcement
                        • Electoral Commission (2023-24): 40 million voter records compromised by hostile state actor, 14 months of system access, consequence was formal reprimand with no financial penalty or personal liability
                        • British Airways GDPR Fine: Initially £183 million, reduced to £20 million, no director consequences despite preventable security failures
                          • Why This Matters for Small Businesses

                          This isn't about attacking business owners. It's about exposing a system that fails everyone:

                          • Honest businesses suffer when competitors cut security corners without consequences
                          • Directors lack incentive to invest in security when breaches only result in fines the company pays
                          • Small businesses become collateral damage when larger organisations treat security as optional
                          • The current approach demonstrably doesn't work - breaches increase year on year despite ICO "guidance"

                            • Understanding this enforcement gap helps you see why cybersecurity culture hasn't undergone the same transformation as workplace safety culture. Part 2 will explore what accountability with teeth would actually look like, and how to protect SMEs whilst implementing it.

                            Resources Mentioned
                            • HSE Annual Report 2023-24: Full enforcement statistics and prosecution details
                            • ICO Enforcement Data: Annual reports showing UK GDPR fine totals
                            • Health and Safety at Work Act 1974: Foundation legislation that transformed UK workplace safety
                            • Corporate Manslaughter and Corporate Homicide Act 2007: Criminal liability framework for organisations
                            • Electoral Commission Breach Report: Technical details of 14-month compromise
                            • EU GDPR Enforcement Tracker: Comparison of UK vs European enforcement approaches
                              • Hosts

                              Noel Bradford 40+ years in IT/Cybersecurity across enterprise and SMB sectors. Former Intel, Disney, BBC. Current CIO/Head of Technology for boutique security-first MSP. Brings enterprise-level knowledge to small business constraints.

                              Mauven MacLeod Ex-NCSC Government Cybersecurity Analyst with deep threat intelligence expertise. Glasgow-based security professional who translates complex government-level security concepts into practical SMB advice.

                              Coming in Part 2

                              "What If Cyber Had Corporate Manslaughter? The Case for Personal Liability"

                              We'll explore:

                              • Specific legislative framework for "Corporate Cyber Manslaughter"
                              • SME protection mechanisms (proportionate thresholds)
                              • How other countries successfully implement director liability
                              • Expected cultural transformations
                              • Practical compliance guidance
                              • What "reasonable care" actually means for small businesses
                                • Take Action

                                1. Share Your Thoughts: Should directors face criminal liability for gross cybersecurity negligence? Comment on our website or social media.

                                2. Prepare for Part 2: Start thinking about what security measures you currently have in place. Could you demonstrate "reasonable care" if asked?

                                3. Review Your Security: Whilst we wait for better enforcement, don't wait to improve your security. Free resources available from NCSC.

                                4. Subscribe: Make sure you don't miss Part 2, where we build the case for what enforcement with teeth would actually look like.

                                5. Forward This Episode: Every business owner needs to understand why the current system fails them.

                                  Episode Details

                                  Runtime: 42 minutes

                                  Release Date: November 17th 2025

                                  Series: Part 1 of 2

                                  Category: Cybersecurity, Business, Technology, Policy

                                  Content Warning: Discussion of regulatory failures, system criticism, and calls for significant policy change. Evidence-based but provocative examination of current enforcement approaches.

                                  Connect With Us

                                  Website: thesmallbusinesscybersecurityguy.co.uk

                                  LinkedIn: [The Small Business Cyber Security Guy]

                                  Email: [email protected]

                                  Tags

                                  #Cybersecurity #SmallBusiness #UKBusiness #DataProtection #ICO #HSE #RegulatoryEnforcement #DirectorLiability #GDPR #BusinessSecurity #CyberAccountability #SecurityPolicy #UKRegulation #DataBreach #ElectoralCommission #CorporateManslaughter #BusinessCompliance #CyberGovernance #SecurityLeadership #RiskManagement

                                  Transcript

                                  Full episode transcript available on our website at thesmallbusinesscybersecurityguy.co.uk

                                  Support the Show

                                  If this episode opened your eyes to the enforcement gap, please:

                                  • Leave a 5-star review on Apple Podcasts
                                  • Share with business owners in your network
                                  • Follow us on LinkedIn for ongoing discussion
                                  • Subscribe to ensure you catch Part 2

                                    • Next Episode: Part 2 - What If Cyber Had Corporate Manslaughter?

                                    All Episodes: thesmallbusinesscybersecurityguy.co.uk/podcasts

                                    The Small Business Cybersecurity Guy Podcast offers practical, actionable cybersecurity advice for UK small businesses. We translate enterprise-grade security into affordable, implementable solutions for businesses with 5-50 employees.

                                    Disclaimer: This podcast provides general information and discussion about cybersecurity and business topics. This is not intended as legal, regulatory, or professional advice. Listeners should consult qualified professionals for personalised guidance tailored to their specific circumstances.

                                    © 2025 The Small Business Cyber Security Guy. All rights reserved.

                                    ...more
                                    View all episodesView all episodes
                                    Download on the App Store
                                    The Small Business Cyber Security Guy | Cybersecurity for SMB & StartupsBy The Small Business Cyber Security Guy