Prosecution options of the Information Commissioner
If Talk Talk as a company are prosecuted under the Data Protection Act, the CEO and the board of directors are all potentially in danger of being prosecuted personally as "culpable directors" by The Information Commissioners Office.
Below is an extract from the ICO's prosecution policy:
Defendants
17.
Where a prosecution is being considered against a body corporate, consideration will be also be given to whether a prosecution is warranted against any individuals in a position of responsibility, such as a director or manager, where the offence was committed with their consent, connivance or attributable to their neglect. Consideration will be given, where appropriate, to the role and responsibilities of the individual, the management chain and the size and structure of the company.
The full document
https://ico.org.uk/media/about-the-ico/policies-and-procedures/1882/ico-prosecution-policy-statement.pdf