It might seem like the only logical option at the time and the best way to get out of the situation as quickly as possible but there’s no guarantees when you are at this point. They might ask for more money and it will only embolden them to continue committing the same crime against other victims. Law enforcement does not encourage, endorse, nor condone the payment of ransom demands but attackers will also threaten to publish data if payment is not made
To counter this, organisations should take measures to minimise the impact of data exfiltration. The NCSC's guidance on protecting bulk personal data and logging and protective monitoring guidance can help with this.
No one expects to be hacked until it happens, so I would suggest to bolster your IT defences with a robust, secure and resilient solution. And remember that even immediately after an attack criminal can be known to return for a second attempt within 12 months.