Disclaimer I Am Not A Lawyer.
The main part of the question is certainly more on topic on law.se, but it has IT security implications.
I assume that the legal part will end to: you are liable for the security of the data unless you can prove that you have used all appropriate measures.
And I am pretty sure that except of some special case (mostly health related data) the appropriated measures are not listed... And even when some are, you should have a detailed security policy describing precisely what is done, when and how, and who is in charge of it. That may dangerous if your security level is low because it will be visible. But it could help because if the security rules are known you will be able to prove what you have done to prevent hacking.
Among the questions:
- what about physical security?
- is there a clean segregation between production machines and non production ones, how is this implemented?
- is there a clean, physical segregation between production and non production network, what are the firewall rules on the junctions?
- how is the peripheral protection implemented, firewalls, reverse proxies, etc.?
- what about in-depth protection (what happens if one machine or application was to be compromised)?
- who has access on production machines, and with which priviledges?
- are the admins and operators made aware of IT security threats, and how?
- what about the backup policy?
- in case of remote administration what are the remote authentication procedures?
- are those procedures reviewed, when, by who and are actions proposed and set up?
- is there any followup on those actions?
- is there a security officer in your organization and how can he/she maintains his/her competences?
I do not expect the above list to beexhaustive, but if you just say huh... when facing one, it will be hard to pretend that you have taken all appropriate measures...