Communication During a Data Breach
How you communicate during a data breach can determine whether your organization recovers trust or suffers lasting reputational damage. Timely, transparent, and empathetic communication is essential.
Communication Framework
Internal Communication (First Priority)
Before any external communication:- Brief executive leadership on scope and impact
- Inform the legal team and DPO
- Activate the crisis communication team
- Ensure consistent messaging across departments
Regulatory Notification
Based on jurisdiction and data type:- GDPR: 72 hours to supervisory authority
- CERT-In: 6 hours from noticing a reportable incident
- DPDP Rules: 72 hours for the detailed report to the Data Protection Board
- HIPAA: 60 days to HHS
- State breach laws: Varies (30-90 days typically)
Customer Communication
When required, communicate:- What happened: Clear, non-technical description
- What data was affected: Specific categories
- What you're doing: Containment and investigation steps
- What they should do: Password changes, monitoring recommendations
- How to get help: Dedicated support channel
Media Response
- Prepare a holding statement immediately
- Designate a single spokesperson
- Be factual: don't speculate or minimize
- Provide regular updates as investigation progresses
- Never say "we take security seriously" without substance
Timing Principles
Do
- Communicate early, even if details are incomplete
- Provide updates as new information emerges
- Acknowledge uncertainty honestly
- Express genuine concern for affected individuals
Don't
- Wait until you have "all the facts" (you never will)
- Minimize the impact or blame users
- Provide technical jargon to non-technical audiences
- Make promises you can't keep
Post-Breach Trust Recovery
- Implement visible security improvements
- Offer concrete remediation (credit monitoring, identity protection)
- Provide a detailed post-incident report
- Engage independent security auditors
- Regular transparency updates on security improvements
Where SuperClue Fits
SuperClue shows the 6-hour CERT-In deadline on each detected breach, drafts the CERT-In report, and can email affected data principals through SendGrid and track delivery. It does not manage media or wider stakeholder communications.