If a cyber security incident happens and directors have nothing to show in terms of cyber due diligence, they face investigation from the ICO.
The Data Protection Act 2018 states all companies must take reasonable steps to protect personal data. If you’re unable to demonstrate you’ve made any decisions about risk, you may face fines.