Incident communication and legal duties: regulators, customers and evidence

Why communication matters

Poor communication can turn a contained incident into a crisis. Staff hear rumours, customers learn from the news, and a regulator finds out from a journalist. Good communication is coordinated (one source of truth), accurate (only confirmed facts, clearly labelled), timely and consistent across audiences.

Communicating with each audience

Avoid guessing in public. Saying "no data was taken" before you know can be badly wrong later. It is better to say what you know, what you are doing and when you will update next. Remember that attackers may be monitoring your normal email, so sensitive coordination should use an out-of-band channel.

Legal and regulatory duties

Under UK GDPR, a controller must report a personal data breach to the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If the risk is high, the affected individuals must also be told without undue delay. Every breach, reported or not, must be recorded internally with the facts, effects and actions taken. You can report in stages if you do not yet have the full picture. The EU GDPR sets the same 72-hour rule for its supervisory authorities.

Other duties may apply depending on your sector and location:

• NIS rules: the UK NIS Regulations 2018 cover operators of essential services and some digital service providers. In the EU, the NIS2 Directive requires an early warning within 24 hours and a fuller notification within 72 hours for significant incidents.
• Sector regulators, such as financial services authorities, may have their own reporting rules.
• Contracts with customers or suppliers often require prompt notice.
• Listed companies may have stock market disclosure duties.

Laws change, so involve legal counsel or the data protection officer early. Some organisations route the investigation through lawyers to help protect certain reports under legal privilege; this varies by country and needs professional advice.

Evidence and records

Regulators, insurers, courts and auditors may all ask for proof of what happened and what you did. Keep a timestamped incident log of decisions and actions, preserve logs and forensic images following forensic principles, and keep copies of every external communication. Good records also make the lessons-learned review honest and useful.

Tip: prepare templates now: a staff notice, a customer notice, a media holding statement and an ICO report checklist. Editing a template is far faster than writing from scratch at midnight.

Real-world example: a lost laptop at a charity

A caseworker at a fictional children's charity reports on Friday evening that her laptop was stolen from a car. It held case notes about families. The incident lead checks the device management console: the laptop was encrypted and is now locked and set to wipe if it connects. The data protection officer assesses the risk to the families as low because of encryption, and records the reasoning in the breach log rather than notifying the regulator; she notes that if encryption had been off, a report to the ICO within 72 hours would have been needed. The police are informed for a crime reference number. Staff receive a short, factual message, without blame, reminding them not to leave devices in vehicles.