After a data breach or cyber incident, an organisation must immediately do three things: stabilise the technical situation, build a reliable factual basis, and centralise communications. How quickly and how structured an organisation responds largely determines how severe the reputational damage will be. The questions below provide concrete guidance for every phase of the response, from the first hours to long-term recovery.
What are the first steps an organisation must take after a cyber incident?
The first steps after a cyber incident are: activating the technical response, assembling a crisis team, verifying facts, and delivering an initial internal briefing. Do not communicate externally until a reliable factual basis exists. Organisations that move too quickly with incomplete or incorrect information make the problem worse rather than managing it.
In practice, this means that Legal, IT/CISO, Communications, and senior management must come together as quickly as possible. The crisis team has one central task: establish facts, divide roles, and align the communication strategy with what is actually known. What do you know? What do you not yet know? Who is affected? Are there statutory reporting obligations that apply?
A common mistake is for communications and the technical response to operate separately. The communications lead needs current, verified information from IT and Legal in order to communicate responsibly. Conversely, IT needs clarity on what may be communicated internally and externally. That alignment must be organised from the very beginning, not after the fact.
Who must an organisation notify in the event of a data breach?
In the event of a data breach, organisations must in most cases notify the Data Protection Authority (DPA), the individuals whose data has been leaked, and — depending on the sector — sector-specific regulators as well. Within the organisation, employees, management, and trade unions must be informed in a timely and accurate manner. The order and timing of this communication are strategically decisive.
The GDPR requires organisations to report a data breach in principle within 72 hours to the competent supervisory authority when a risk exists to the rights and freedoms of data subjects. This is a legal obligation, not a choice. When the risk is high, the individuals concerned must also be notified directly. The precise assessment of the risk requires legal expertise.
In addition to regulators, there are typically other stakeholders who must be informed in a timely manner:
- Employees and internal teams, so that they can respond correctly to questions from customers or media
- Customers or consumers whose data has been compromised
- Partners and suppliers who may also have been affected
- Shareholders or investors, if the impact is material
- Media, at the point when external communication is responsible and prepared
The order of stakeholder communication is not a detail. Those who inform too late lose control of the narrative. Those who communicate too early without a factual basis create confusion and a loss of credibility.
How do you communicate externally about a data breach without increasing reputational damage?
Communicating externally about a data breach without increasing reputational damage is possible when you communicate transparently, in a timely manner, and consistently on the basis of verified facts, without speculating about what you do not yet know. An honest, calm, and structured account causes less damage than one that must be corrected later.
Key messages must be fully aligned internally before they are released externally. Contradictory statements from different spokespeople or departments undermine trust more quickly than the incident itself. Ensure a single point of communication and a single validated message.
A few concrete principles for external communication during a cyber crisis:
- Communicate what you know, acknowledge what you do not know. Do not speculate. “We are actively investigating this and will share more information as soon as possible” is stronger than an incomplete or inaccurate account.
- Show concern for those affected. Acknowledge the impact on customers, employees, or other parties involved. Empathy is not a weakness — it is a component of credible communication.
- Actively communicate about the measures you are taking. What are you doing to limit the damage? What are you doing to prevent recurrence? This gives stakeholders something to hold on to.
- Keep control of the timing of communication. Anticipate media contact and prepare spokespeople with clear Q&As and an aligned statement.
- Ensure consistency across channels and languages. In a Belgian context, this also means alignment across language groups and internal audiences.
What mistakes do organisations make most often in communications after a cyber crisis?
The most common communication mistakes after a cyber crisis are: responding too late, saying too little, delivering contradictory messages, and neglecting internal communications. Each of these mistakes amplifies reputational damage and undermines the trust the organisation is trying to restore.
Responding too late gives media, social media, and rumours the space to shape the narrative. Even a brief holding statement confirming that the organisation is investigating the incident is better than silence.
Underestimating internal communications is a particularly persistent mistake. Employees who learn what happened through the media do not feel taken seriously. They are also spokespeople, consciously or unconsciously. Those who fail to inform them in time lose a crucial ally.
Inconsistent messages arise when Legal, IT, HR, and Communications each communicate separately without alignment. An integrated approach in which all disciplines work from one aligned strategy prevents this.
Overly legalistic language or defensive communication breeds distrust. A statement that sounds more like a legal disclaimer than a human response misses its mark with customers, media, and other stakeholders.
How do you rebuild stakeholder trust after a data breach?
Rebuilding trust after a data breach requires time, consistency, and demonstrable action. It does not begin after the crisis, but during the response itself: those who communicate transparently and respectfully while the incident unfolds lay the foundation for recovery. Concrete evidence of improvement is then decisive.
After the acute phase, the following elements are key to sustainable trust recovery:
- Clear communication about what happened, once the facts have been fully established. Those affected want to understand what went wrong.
- Visible measures that demonstrate the organisation has drawn lessons: technical improvements, process adjustments, revised policies.
- Active stakeholder engagement: proactive contact with customers, partners, or other affected parties, without waiting for them to ask questions.
- A long-term narrative that positions the organisation as one that takes responsibility and invests in improvement.
- Correction of inaccurate information circulating in the media or online, and making current, authoritative information available through the organisation’s own channels.
Trust is not rebuilt with a single press release. It is a process of consistent communication, active dialogue, and demonstrable change over an extended period.
How do you prepare an organisation for a future cyber incident?
An organisation prepares for a future cyber incident by developing a crisis communication plan, testing the crisis team structure through simulations, updating stakeholder mapping, and training spokespeople. Preparation is the most effective way to limit the communicative impact of a future incident.
Crisis preparation in terms of communications involves more than a document that disappears into a drawer. It is a living system that is regularly tested and updated. Concrete elements include:
- An up-to-date crisis communication plan with clear roles, mandates, and escalation criteria
- Pre-drafted holding statements and Q&As for various cyber scenarios
- A stakeholder mapping indicating who must be informed in what order
- Media training and spokesperson training for relevant senior leaders
- Tabletop exercises or crisis simulations to test the response under realistic conditions
- A post-incident review after every incident — including smaller ones — to structurally improve processes
A vulnerability audit helps identify blind spots in preparedness: which scenarios have been insufficiently thought through? Which stakeholders are missing from the mapping? Which spokespeople are insufficiently trained? Asking those questions before a crisis strikes is the essence of good crisis readiness.
How Whyte helps with communications after a data breach or cyber incident
Whyte Corporate Affairs supports larger organisations and multinationals across the full crisis cycle of a cyber incident: from preparation and response to reputation recovery. The approach is integrated: communications, stakeholder management, media relations, and internal communications are not treated as separate disciplines, but as components of one coherent strategy.
Concretely, Whyte provides support with:
- Building a reliable factual basis and determining key messages in the acute phase
- Drafting and aligning external statements, Q&As, and internal briefings
- Stakeholder communications towards regulators, employees, customers, media, and other parties involved
- Spokesperson support and media relations during and after the incident
- Reputation analysis and trust recovery after the acute phase
- Crisis preparation through plans, simulations, and training, so that the organisation is better positioned for a future incident
Whyte works closely with the organisation’s internal teams — including Legal, IT, HR, and Operations — and acts as the communications coordinator between the disciplines involved. Technical or legal expertise is not replaced, but complemented with strategic communications advice and hands-on execution. Want to know how Whyte can support your organisation with crisis communications and reputation management? Get in touch for an initial conversation.
Frequently Asked Questions
How long does it typically take for an organisation to fully recover after a data breach?
The duration of full reputation recovery after a data breach varies considerably, but research indicates that this typically takes between six months and two years. Organisations that respond quickly, transparently, and in a structured manner recover significantly faster than those that allow communications to drag on or deliver inconsistent messages. What is decisive is not only what happened, but how the organisation handled it.
What do I include in a holding statement when the facts are not yet fully known?
A good holding statement confirms that the organisation is aware of the incident, that immediate action is being taken, and that more information will follow as soon as possible. It does not need to contain details you do not yet have. Concretely, it could read: ‘We are aware of an incident that has affected our systems. We are actively investigating the situation and taking the necessary measures. We will communicate further information as soon as the facts have been established.’ Silence is always the worst option at this stage.
Should an organisation communicate even if the data breach was limited and affected few people?
Yes, even in the case of a limited data breach, statutory reporting obligations apply under the GDPR, regardless of the scale. Whether external communication towards those affected or the media is necessary depends on the level of risk to the individuals concerned and the nature of the data leaked. A legal assessment is always the first step. Do not underestimate minor incidents either: if they later come to light without you having communicated proactively, the reputational damage is often greater than the incident itself.
How do I deal with negative coverage or inaccurate information in the media during a cyber crisis?
Respond quickly, factually, and through the right channels: send a correction to the relevant editorial team, publish a clear statement on your own website, and ensure your spokespeople convey the same corrected message. Do not become defensive or engage in debate on social media, but offer authoritative, verifiable information as an alternative. An active media relations strategy — in which you proactively provide journalists with accurate information — is more effective than reactively correcting the record.
How often should our crisis communication plan be reviewed and tested?
A crisis communication plan deserves a thorough review at least once a year, and a targeted evaluation after every incident — large or small. Tabletop exercises or crisis simulations should ideally be organised at least annually, so that the teams involved remain familiar with their roles and the plan remains aligned with the current organisational structure. Stakeholder mappings and contact details become outdated quickly and must be kept continuously up to date.
What is the difference between a DPO and a crisis communications advisor, and do I need both?
A Data Protection Officer (DPO) is responsible for the legal and compliance-related handling of a data breach, including notification to the Data Protection Authority. A crisis communications advisor translates the factual and legal situation into a strategic communications approach towards all stakeholders: employees, customers, media, and regulators. Both roles are complementary and indispensable: the DPO determines what may and must be said from a legal perspective, while the communications advisor determines how, when, and through which channels that happens.
How do I involve employees in communications during a cyber crisis in a responsible way?
Always inform employees before external communications go out, so that they do not learn what happened through the media. Provide them with a clear briefing on what they may and may not say if they receive questions from customers or their surroundings, and designate an internal point of contact for questions. Employees are inevitably ambassadors of the organisation, even during a crisis: those who inform and support them well gain a crucial ally in reputation recovery.
Related Articles
- What Is a Crisis Simulation and What Does It Offer an Organization?
- How to Communicate Internally During a Restructuring or Collective Dismissal
- How Does an Organization Deal With Disinformation During a Crisis?
- What Is a Post-Incident Review and When Should You Conduct One?
- What Should an Organization Do After a Data Breach or Cyber Incident?
This content was generated with the help of AI and it may contain mistakes