Introduction

Scope and primary sources

Principal categories of offences

• Unauthorized access to computer systems or networks (commonly described as "hacking");
• Acquisition, copying or disclosure of data without lawful authority (often referred to as data theft or unlawful data access);
• Use of digital communications to threaten, harass or defame individuals (online harassment and related conduct);
• Dissemination of false or misleading information online that may affect public order or individual rights (sometimes characterised in public materials as misinformation or disinformation); and
• Digital fraud, identity misuse and financial schemes facilitated by electronic means.

Penalties and remedies: cautious overview

Jurisdiction and enforcement agencies

Evidence, preservation and admissibility

• Preserve evidence promptly: retain original devices, take forensic images where appropriate, and keep logs of what is done to preserve chain of custody;
• Avoid alteration of data: do not alter, delete or overwrite files or logs unless under professional direction; inadvertent changes can affect admissibility;
• Document steps taken: maintain a contemporaneous record of all actions taken in relation to the incident (who did what, when and why); and
• Use qualified forensic practitioners: where forensic analysis is necessary, engage persons who can provide methodology and provenance statements that will be acceptable in court or regulatory proceedings.

Reporting and investigation: practical steps

1. Immediate technical containment: Limit further access or damage by isolating affected devices or systems where feasible. These actions should be coordinated with IT and legal advisors to preserve evidence.
2. Document the incident: Capture screenshots, metadata, email headers, server logs, timestamps and any other artefacts that show the incident and actions taken.
3. Engage forensic and cybersecurity expertise: Use independent or accredited forensic analysts to secure and analyse data; ask for written reports that explain methods and findings.
4. File a police report: Where a criminal offence is suspected, file a formal report with the local police station or the specialised cyber unit. Keep an official copy and a reference number for follow-up.
5. Notify specialised enforcement units: If necessary, inform the Criminal Investigation Department (CID) or the police cybercrime unit for specialist handling of the matter.
6. Consider civil remedies and regulatory notifications: Decide whether to pursue civil relief (injunctions, damages) or to make regulatory notifications; requirements will vary by sector and by contractual undertakings.
7. Follow up: Maintain regular contact with investigators and retain counsel to protect legal rights and to coordinate any disclosure obligations.

Interactions with internet service providers and intermediaries

Cross-border and mutual assistance considerations

• Mutual legal assistance treaties or letters rogatory;
• International cooperation through police liaison channels; and
• Coordination with foreign service providers subject to other jurisdictions' legal processes.

Practical risk-reduction measures for organisations

• Maintain up-to-date incident response plans that set out legal and technical responsibilities;
• Train employees on phishing, credential hygiene and secure remote access;
• Apply technical controls: logging, multi-factor authentication, network segmentation and regular patching;
• Conduct periodic penetration testing and tabletop exercises that include legal and PR stakeholders; and
• Establish contracts with forensic and incident-response providers so they can be quickly engaged when needed.

Common procedural pitfalls

• Failing to preserve evidence promptly or allowing uncontrolled access to affected systems;
• Not engaging forensic expertise early, which can affect the quality of analysis and admissibility of evidence;
• Overly public commentary that prejudices investigations or civil litigation;
• Missing statutory or contractual notification obligations because of uncertainty about who must be informed; and
• Assuming that informal requests to foreign providers will result in rapid cooperation without formal legal process.

2026 update

How TRW Law Firm can assist

Sector-specific considerations

When to involve counsel

• Assess whether conduct amounts to a reportable offence, and advise on the benefits and risks of reporting;
• Protect privilege and advise on what technical communications may be privileged;
• Manage disclosure obligations in litigation or regulatory proceedings; and
• Coordinate external communications to minimise legal risk while preserving relationships with stakeholders.

Practical checklist for immediate response

1. Isolate affected systems if that will not destroy evidence.
2. Engage IT and forensic responders to image and document affected systems.
3. Notify internal legal counsel and relevant executives.
4. Collect and preserve logs, email headers and other relevant metadata.
5. Decide whether to notify police or regulatory authorities, and prepare factual materials to support any report.
6. Consider communications to affected parties and prepare a holding statement that protects legal interests.

Five practical frequently asked questions

Reporting contacts and official sources

Concluding remarks