Supposing this is a freelancer & client in the EU and that a website was reasonably secured when developed.
Imagine there are no written contracts and a year after delivery this client's website suffers an attack and its sensitive data is stolen.
Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.Sign up to join this community
Normally, an independent contractor is liable for their own torts. So, if the breach occurred because of the freelancer’s negligence, an aggrieved third party could sue the principal, the freelancer or both. The common law position is that they are jointly and severally liable (i.e. each is responsible for their own and the other’s breach), however, many jurisdictions have passed proportionality statutes that limit exposure to the proportion that each contributed. Also, some jurisdictions have professional liability limitation schemes that limit maximum exposure if the professional complies with the requirements.
The contract can change this position as between the principal and the freelancer - it can’t, of course, bind third parties but given that an aggrieved party is likely a user of the principal, the contract between them will be relevant as well. So, for example, the principal could indemnify the freelancer against third-party claims (or vice-versa).
If the freelancer breached the contract (e.g. there was a warranty, explicit or implied, that the website would have a certain level of security and it doesn’t) then the principal can recover its losses from the freelancer. The freelancer’s liability would be reduced by any contributory negligence by the principal, potentially to zero.
This is what professional indemnity insurance is for - then it’s the freelancer’s insurer’s problem.
You note the absence of a written contract. Most contracts don't have to be written to be valid, (Contracts on some issues have to be written or even notarized to become valid, details differ between the EU member states.) But without a written contract, I find it implausible that the developer would have guaranteed any sort of fitness for purpose one year after deployment, without maintenance, unless a lot of money changed hands.
Most open-source and commercial software includes boilerplate language disclaiming liabilities, but that's often aimed at global audiences.
A client who operates software for more than a year without regular security checks and updates/upgrades would act unprofessional (again in my opinion, details might differ between jurisdictions). The GDPR requires adequate technical and organisational measures be the client to safeguard data. This might cause liability.