The fallout was immediate and far-reaching: production lines halted across five countries, 33,000 employees sent home and suppliers – many of whom rely on JLR’s systems for invoicing and payments – left scrambling. Some were even advised to apply for Universal Credit to stay afloat. The financial impact is estimated to exceed £1.7 billion. 

This incident is more than a cautionary tale – it’s a stark reminder that vendor management is no longer a peripheral concern. It is now a central pillar of cyber resilience and legal risk mitigation. 

JLR’s reliance on SAP systems appears to have been a key vulnerability. When those systems failed, the company had no alternative infrastructure to fall back on. Unlike British Airways, which had contingency systems in place during its own cyber crisis, JLR was left exposed. This lack of redundancy highlights the importance of identifying single points of failure and ensuring that both internal and vendor systems are stress-tested for continuity. 

 

Legal and regulatory considerations in vendor contracts: Lessons for businesses

From a legal and regulatory standpoint, vendor contracts must go beyond operational convenience –they must serve as robust instruments of risk management and compliance. 

Key contractual elements should include: 

  • Regulatory Alignment: Contracts must explicitly reflect obligations under UK GDPR and other applicable data protection laws, particularly where personal data is processed or shared. This includes ensuring lawful bases for processing, data minimisation, and cross-border transfer safeguards. 
  • Defined Service Standards: Service Level Agreements (SLAs) should clearly articulate performance metrics such as system availability, recovery time objectives (RTOs), and breach notification timelines, ensuring vendors are held to measurable standards. 
  • Incident Response Protocols: Contracts should contain detailed provisions for managing data breaches, including roles and responsibilities for containment, investigation, regulatory reporting, and affected party communication. 
  • Cybersecurity and Insurance Requirements: Vendors must be contractually obligated to maintain appropriate cybersecurity measures and carry adequate cyber liability insurance. Any lapses in coverage or security posture should trigger mandatory disclosure and review. 
  • Audit and Oversight Rights: Businesses should retain the right to audit vendor compliance with contractual and regulatory obligations, including data handling practices and security controls. 

Without these safeguards, organisations expose themselves to significant regulatory risk, reputational damage, and potential enforcement action—particularly where personal or sensitive data is involved.