The message that matters most.
WHEN IT IS REQUIRED
Where the breach is likely to result in high risk to individuals.
WHAT HIGH RISK DEPENDS ON
The type of data How many people What could be done with it Whether it was protected
WHAT THE MESSAGE MUST CONTAIN
What happened, in plain terms What data was involved What the likely consequences are What you have done What they should do How to contact you
WHAT TO LEAD WITH
What happened and what data.
WHY NOT AN APOLOGY
They want the facts first.
WHAT TO BE SPECIFIC ABOUT
Exactly which fields were exposed.
WHY
Vagueness leaves people assuming the worst.
WHAT PRACTICAL ADVICE TO GIVE
Changing passwords, if credentials were involved Watching for fraudulent contact Contacting their bank, if financial details were involved
WHAT TO AVOID
Minimising Technical language Blaming a third party Burying it in other communication
WHAT CHANNEL TO USE
Direct contact, where possible.
WHAT TO DO IF INDIVIDUAL CONTACT IS NOT POSSIBLE
A public communication, prominently.
WHAT TO PREPARE
Staff briefed to answer questions.
WHAT TO EXPECT
Anger, and questions you cannot yet answer.
WHAT TO DO ABOUT THOSE
Say when you will know.
