Should we report a cyber incident to the police as well as the regulator?

Often yes, but it is a separate decision from regulatory reporting. A ransomware attack, data theft, fraud or extortion is usually a crime, and a criminal complaint can help with insurance claims, with banks trying to recall a fraudulent transfer, and with investigations that link your case to others; some insurers ask for a police reference. A complaint to the police does not replace notifications to the CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported., the competent authority or the data protection authority, and those do not replace a complaint. Many countries have specialised cybercrime units or online forms. Before filing, agree with your lawyers and incident-response firm what evidence to hand over and how to preserve it, so you do not destroy what investigators need. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. early warnings already ask whether you suspect an unlawful or malicious act; your answer and a police report should be consistent.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics