Can a company be liable for a breach by an untrained hire?

Yes. A company can face liability when an untrained hire causes a data breach if the company violated an applicable legal duty, failed to use reasonable safeguards, or breached a contractual obligation. Missing training is evidence of a possible control failure, not automatic proof of liability; the outcome also depends on the employee’s actions, the affected data, causation, and the governing law.

TL;DR

• Company liability untrained employee data breach questions depend on legal duties, safeguards, and causation—not training alone.
• HIPAA requires workforce training; missing records can expose a gap between policy and practice.
• A training certificate does not prove that access controls, incident response, or contractual obligations were adequate.
• Preserve evidence, contain the incident, and assess notification duties before treating retraining as the solution.

Can a company be liable for a breach by an untrained hire?

Yes. The strongest question is not who clicked, but which duties the company failed to meet. Different legal routes require different evidence. A regulator’s investigation, a customer’s contract claim, and an individual’s negligence claim are not interchangeable.

Legal route	What investigators or claimants examine	What missing training establishes
Regulatory enforcement	Whether applicable privacy or security requirements were met	A possible violation where training is required, or evidence of inadequate safeguards
Negligence claim	Duty, breach, causation, damages, and jurisdiction-specific rules	Possible evidence of unreasonable conduct, not every element of a claim
Contract claim	Security promises, service obligations, and allocation of responsibility	A possible failure to deliver promised training or controls
Employer responsibility	Whether the employee’s conduct is attributable to the employer under applicable law	Training status alone does not decide attribution

Why this matters

A new hire’s mistake can expose failures in onboarding, account provisioning, supervision, and incident handling. Calling the incident employee error does not answer whether the company made that error unnecessarily damaging.

MSPs evaluating Defend Wise security awareness training should treat training as one safeguard, not a liability shield. For a 2026 service agreement, define who enrolls new users, who restricts access, and who preserves evidence when onboarding breaks down.

The practical goal is straightforward: make the company’s safeguards defensible before an incident, then preserve proof of what actually happened. A policy that nobody implemented does not establish that an employee received instruction.

When missing training creates legal exposure

Missing training matters most when it connects to a specific obligation. Start with the law, contract, or representation that required the company to act—not with an assumption that every breach creates the same liability.

A regulation requires training

For HIPAA-covered entities, the Privacy Rule requires training on relevant privacy policies and procedures under 45 CFR §164.530(b). The HIPAA Security Rule separately requires a security awareness and training program for workforce members under 45 CFR §164.308(a)(5).

Those requirements have different scopes. Determine whether the organization is a covered entity or business associate, which information was affected, and which provision applies before describing a missed course as a regulatory violation.

The FTC Safeguards Rule also requires covered financial institutions to provide personnel with security awareness training under 16 CFR §314.4(e). That obligation does not apply to every employer simply because the employer holds customer information.

The company failed to take reasonable precautions

Even without a training-specific statute, inadequate instruction can matter to a negligence claim. The claimant still must establish the elements required by the relevant jurisdiction, including a recognized duty, breach, causation, and legally recoverable harm.

Suppose an employee receives access to sensitive records without instructions on handling suspicious requests. That omission is relevant to assessing the company’s conduct, but it does not independently prove that training would have prevented the incident or that every claimed loss is recoverable.

A contract promised training or safeguards

A customer agreement can create obligations beyond a company’s general legal duties. If the company promised workforce training, restricted access, or documented onboarding, compare the promise with the records.

Read the entire agreement. Liability limits, exclusions, indemnities, notice requirements, and responsibility allocations affect the analysis; a training clause should not be read in isolation.

For an MSP, separate the provider’s obligations from the end-client employer’s obligations. A service agreement should not leave both parties assuming that the other party owns enrollment or overdue-training follow-up.

Why liability varies

The same employee mistake can produce different legal outcomes. These factors explain why:

• Applicable law: Sector, jurisdiction, and organizational role determine which duties apply.
• Affected information: Health information, financial information, and ordinary business records can trigger different requirements.
• Access granted: Examine whether the employee needed the permissions that made the incident possible.
• Instruction provided: Check content, timing, delivery, and whether the instruction addressed the task involved.
• Connection to harm: Distinguish a missing control from evidence that the missing control caused the loss.
• Contract terms: Compare actual conduct with written promises and the agreement’s allocation of responsibility.

Avoid reducing this assessment to a completion percentage. A completed course cannot answer whether an employee had unnecessary access, whether a suspicious request bypassed approval, or whether an alert received a timely response.

What should a company do after an untrained hire causes a breach?

Contain the incident and preserve evidence before changing the training record. Retraining belongs in remediation, but it does not replace investigating what happened or assessing legal obligations.

Use this sequence for your 2026 incident-response checklist. Assign an owner to each step so the handoff does not become another untracked task.

1. Contain access. Disable compromised sessions, restrict affected accounts, and stop ongoing exposure through the incident-response process. Preserve relevant logs while taking containment action.
2. Preserve evidence. Retain messages, account activity, onboarding records, training assignments, policy versions, and access approvals. Coordinate preservation with counsel and the response team.
3. Map obligations. Identify affected data, relevant jurisdictions, customer commitments, insurance conditions, and notification requirements. Do not assume every obligation uses the same trigger or deadline.
4. Assess causes. Reconstruct the employee’s actions alongside technical controls and approval processes. Establish whether training was absent, late, irrelevant, or completed but insufficient for the task.
5. Repair controls. Address access, instruction, supervision, and response failures separately. Record what changed and how the company will verify that the change works.

This sequence separates immediate response from longer-term correction. It also prevents a newly completed course from obscuring the fact that training was missing when access was first granted.

Preserve the original record before adding corrective training.

Which breach deadlines matter in 2026?

Training gaps do not pause notification duties. The applicable deadline depends on the law, the organization’s role, and the facts that trigger the obligation.

Requirement	Deadline or retention period	Scope and qualification
GDPR Article 33	72 hours	A controller must notify the supervisory authority after becoming aware of a personal data breach, unless the breach is unlikely to risk individuals’ rights and freedoms; explain delays
HIPAA individual notification, 45 CFR §164.404	60 calendar days	A covered entity must notify affected individuals without unreasonable delay and no later than this period after discovery of a breach of unsecured protected health information, subject to applicable exceptions
HIPAA Privacy Rule documentation, 45 CFR §164.530(j)	6 years	Required documentation must be retained from creation or the date it was last effective, whichever is later

The GDPR’s 72 hours is not a universal deadline for every company or every recipient. HIPAA’s 60 calendar days is an outer limit for the specified notification, not permission to wait when earlier notice is required by the circumstances.

Likewise, HIPAA’s 6 years applies to required Privacy Rule documentation; it is not a universal retention period for all security logs. For your 2026 retention schedule, map each record category to its actual legal, contractual, and preservation requirements.

What training evidence should the company keep?

Keep evidence that explains what the employee was expected to know when the incident occurred. A current dashboard alone does not establish the state of onboarding at an earlier point.

• Assignment record: Who received the training requirement, and when?
• Content version: Which instructions and policies did the employee receive?
• Completion record: What was completed before access began and before the incident?
• Role connection: Did the material address the employee’s actual responsibilities?
• Exception record: Who approved delayed training or access before completion?
• Follow-up record: What happened after missed assignments or identified knowledge gaps?

Preserve records accurately. Do not backdate completion, overwrite the original timeline, or describe post-incident remediation as a control that existed beforehand.

For MSPs, evidence also needs a clear organizational boundary. Records should identify the relevant end-client organization rather than leaving the reviewer to infer which workforce a completion report covers.

Does completed security training protect the company from liability?

Completed security training is evidence of instruction, not immunity. A company can deliver training and still face exposure because access controls, contractual performance, supervision, or incident response were inadequate.

Evaluate training against the failure being investigated. A general awareness module does not prove that an employee understood a specialized data-export procedure or received instructions for verifying a sensitive request.

The reverse also matters. An overdue assignment does not establish that the employee caused the breach or that the company violated every applicable requirement. Keep the legal conclusion separate from the operational finding.

Can an MSP be liable when its client’s employee causes a breach?

An MSP can face liability for its own contractual failures or other actionable conduct, even when a client employee initiated the incident. The employee’s involvement does not settle whether the MSP performed the services it agreed to provide.

Review enrollment responsibilities, access administration, reporting commitments, escalation duties, and evidence delivery. Identify which tasks the client retained and which tasks the MSP accepted.

For a 2026 client-service review, test the handoff against a real onboarding scenario. If a client fails to report a new starter, determine how that affects the MSP’s obligations under the agreement rather than assuming either party has no responsibility.

Where a training platform fits

Defend Wise is best for MSPs seeking white-label security awareness training with unlimited seats. Its stated model addresses seat-count friction when MSPs train users across end-client organizations.

The limitation is equally important: Defend Wise security awareness training does not itself establish legal compliance or remove liability. The company and its service providers still need to define responsibilities, manage access, assess incidents, and meet applicable obligations.

When evaluating Defend Wise, ask how your onboarding process will capture assignments, completion, exceptions, and client-specific evidence. Treat those as evaluation requirements—not assumptions about features or legal outcomes.

FAQ

Can my company be sued if a new employee causes a data breach?

Yes, a company can be sued after a new employee causes a data breach. Whether a claim succeeds depends on the applicable duties, evidence, causation, damages, and jurisdiction—not simply the employee’s training status.

Is failing to train an employee automatically negligence?

No, missing training does not automatically establish negligence. It can support a claim, but the claimant must still establish the elements required by the relevant jurisdiction.

Does a signed security policy count as completed training?

A signed policy acknowledgment does not, by itself, prove that required training occurred. Preserve the actual instruction, delivery details, and completion evidence relevant to the applicable obligation.

Can I blame the employee instead of the company?

Blaming the employee does not remove the company’s own legal or contractual obligations. Assess the employee’s conduct alongside access controls, onboarding, supervision, and the rules governing employer responsibility.

How quickly must a company report a breach under GDPR?

72 hours is the GDPR Article 33 supervisory-authority notification period for a controller after awareness, unless the breach is unlikely to risk individuals’ rights and freedoms. It is not a universal notification deadline for every organization or recipient.

How long should HIPAA privacy documentation be retained?

6 years is the HIPAA Privacy Rule retention period for required documentation, measured from creation or the date it was last effective, whichever is later. That rule does not establish one retention period for every security record.

Does retraining after a breach fix the company’s liability?

Retraining does not erase earlier failures or resolve liability by itself. It belongs in a documented corrective response alongside containment, investigation, access changes, and any required notifications.

One last thing

The most useful onboarding question is not whether the new hire finished training. It is who approved the access available before training was complete.

Put that decision in the record. A named owner, a documented exception, and a clear access boundary give your investigation something concrete to examine; a completion certificate generated afterward does not reconstruct the missing decision.