Some of our data is missing!

How do you talk your way through a data breach?

It’s a 21st century crisis – what do we do if someone has stolen some of our data? Indeed, what do we do if we have lost some of our data? With GDPR in force, and new rules governing use of personal data also in place in the Channel Islands, many businesses are facing up to the challenge of what they would do in the event that some of their data went missing.

Regardless of the cause of the loss, businesses are judged on their reaction to it. I recently joined a panel event hosted by law firm Appleby to discuss what businesses can do in this (increasingly likely) situation. The panel featured legal, technical and regulatory experts along with communications professionals (myself included) and covered the steps needed to prepare for crisis situations and how to react and manage events as they unfold.

I was asked for one part of the event to provide some ‘dos and don’ts’ for businesses in the event of a data breach – here are my suggestions!

Dos

Practise! Don’t let the first time you stand in front of a camera be a live TV interview about a crisis situation. Practice makes perfect. Get some advice from a professional and don’t wing it.

Be responsive! Answer enquiries, take phone calls, give answers. Even if you can’t give the whole picture it is important to engage, especially with the media. Explaining why you can’t talk about something is better than radio silence - it shows that you’re on top of the situation and actively managing it, not panicking behind-the-scenes and going into lockdown..

Keep going! It may seem like everyone moves on to the next story very quickly however you can take that opportunity to keep communicating effectively and making sure that your messages are the final word on the crisis.

Don’ts

Wait! It can be tempting to wait until this all blows over. But if someone else breaks your story you will look dishonest and unethical – something your reputation may never recover from. If you are proactive you can control your messages more effectively, and you’ll cultivate a reputation as a transparent, honest business.

Hide! Have you been given a deadline to respond to the media but aren’t answering calls or supplying a statement? ‘Declined to comment’ sounds a lot worse than ‘We’re sorry we can’t answer that right now’.

Lie! Well this one should be obvious but even so the temptation can be there to suggest fewer people are affected than really are, or that procedures were followed when they weren’t. It’s not allowed so just don’t do it.