In the GDPR regulation (Article 39, on page 7), it says
Personal data should be processed in a manner that ensures
appropriate security and confidentiality of the personal data,
including for preventing unauthorised access to or use of personal
data and the equipment used for the processing.
So this is down to the controller. If the controller is not willing to learn and adapt security controls and mechanisms then they may fall short and could result in a breach. The reason why the regulation may not put how to protect the data is that every company is different and will require different security measures. It's also good to follow certifications like Cyber Essentials and ISO 27001 to ensure the correct security controls and procedures are in place.
I'm not too sure on the legal side of being sued, but I suppose if it's in a contract of work stating certain security measures are in place then they are at breach of the contract.