Who in the company should decide on a ransom demand?
The management body, advised by lawyers, the insurer and the incident-response firm, and never one person alone under pressure. Before any decision the company needs facts: can systems be restored from backup, and how fast; did data actually leave, and how much; is a payment lawful at all, given sanctions on some criminal groups; and what does the insurance policy say. Attackers often claim to have copied data to raise the pressure, so test that claim against evidence. Agree in advance who takes this decision and who must be consulted. Paying guarantees neither working decryption nor deletion of stolen data. NetSenX does not advise on payment; it can show whether unusual uploads left monitored devices in the days before the attack, and to which destinations.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.