Crisis Communication Best Practices for Data Breaches, Recalls and Strikes

Breach, Recall or Strike: What Is the Same and What Is Not

All three events have an affected group, a deadline to tell someone and a story people will search for. What differs is who you must tell and how fast.

A data breach harms people through what was taken. A recall harms people through what they bought. A strike harms people through what stops working. Each triggers a different rule and a different audience.

They share the same communication pattern: notify, say, repair. Notify the people and agencies who must hear first. Say one true thing in plain words. Repair what caused it and what people can now find about it. This guide gives that sequence for each, and a table of notification clocks.

It builds on our general guide to crisis communication best practices. For real cases that show the sequence in action, see crisis management examples.

How Long After a Breach or Recall Must You Notify?

It depends on the rule. Some clocks run in hours, some in days. Several can apply to one event, and state laws add more.

Data Breach Communication: One-Page Sequence

A clear order works best: secure, fix, notify, then communicate. Here is that order as a working sequence.

Notify

• Law enforcement, starting with local police and the FBI or Secret Service where needed
• Businesses whose data you hold, and institutions that monitor affected accounts
• Credit bureaus if Social Security numbers were stolen
• Regulators, where a rule such as HIPAA or the Safeguards Rule applies
• Affected individuals, promptly and in plain language

Say

A good letter covers five things: what happened, what information was involved, what you are doing, what individuals can do, and where to get updates. It suggests a free alert on their credit file or a credit freeze, a review of credit reports and the IdentityTheft.gov site for recovery steps. Where financial data or Social Security numbers were exposed, offer at least a year of free credit monitoring or identity restoration.

Be accurate and avoid misleading statements, share details that help people protect themselves without raising their risk, and post plain answers to likely questions on your website. State how you will contact people in future so they can recognize real messages.

Repair

• Fix the vulnerability and tell people the fix is done, with a date
• Keep the updates page live and dated for months, not days
• Search your company name and the word breach in a private window each week
• Report content that exposes people's personal data to the platform that hosts it
• Publish accurate pages about your security work so search has better material to show

For finance and healthcare, the rules are stricter. See crisis communications for financial services and crisis communications for healthcare.

Product Recall Communication: One-Page Sequence

Report to the safety agency fast, stop sales, tell owners clearly what to do and keep the notice simple.

Notify

Under the Consumer Product Safety Act, manufacturers, importers, distributors and retailers of consumer products must report to the CPSC within 24 hours of obtaining reportable information. That includes a defect that could create a substantial risk of injury, a product that creates an unreasonable risk of serious injury or death and a product that fails an applicable safety rule. The CPSC says an injury is not required, and its staff advice is, when in doubt, report.

The CPSC Fast Track program lets a company that reports a defect choose to begin the recall within 20 working days. Reports go in through the agency's online business portal. Participants approve a draft recall press release as part of the process.

For food, drugs and devices, the FDA's guidance on product recalls, including removals and corrections, covers the company's role. The recall responsibilities of firms are set out in 21 CFR 7.40 to 7.59, and the FDA has separate guidance on public warnings and notification.

Say

• Name the product, with model numbers, dates and where to find the identifier
• Say the hazard in plain words, such as can overheat or may contain an allergen
• Say exactly what owners should do: stop using it, return it, get a refund or a repair
• Give one phone number and one web page, and keep both staffed and live
• Send direct notices to buyers you can reach, and ask retailers to post the notice
• Do not minimize. An understated recall is the one that gets re-reported

Repair

• Fix the root cause and say what changed
• Keep the recall page up for as long as people may own the product
• Reply to reviews of the recalled item with the same recall steps
• Watch for lookalike or copied recall pages and report ones that misuse your name
• Publish what you changed in testing or supplier checks, so search shows the fix next to the recall

Labor Strike Communication: One-Page Sequence

A strike is a public dispute with your own people. Customers want to know whether service will continue. Staff want to hear respect. Counsel should review every statement.

We cite no agency rule for strikes here, because the rules that matter are labor law and your contracts. Ask your labor counsel before any statement to staff, the union or the public.

Notify

• Your labor counsel, first
• Your leadership team and your board
• Customers and partners who depend on continued service, with the facts on what is affected
• Your own staff, before they read it in the news

Say

• What is open, what is delayed and how customers can reach you
• A short, respectful statement about your willingness to keep talking
• No personal attacks on staff or the union, and no guesses about how long it will last
• One page of dated updates, and one spokesperson

Repair

• When it ends, say what was agreed in a few lines and thank customers for patience
• Review the reviews and posts that grew during the dispute and report what breaks platform rules
• Check what search shows for your company name, and fix or add accurate pages

What Search and AI Answers Show After the Event

People will look you up for months after a breach or recall. What they find is partly yours to shape, and partly not.

Agency notices, news stories and court filings stay online. A firm cannot remove them, and you should doubt any that says it can. What you can change is the rest of the picture: your own update page, accurate profiles, clear answers on your site and rule-breaking content reported to its host.

AI tools summarize what they find. They do not take instructions from you. A clear, dated, well-sourced account of the problem and the fix gives them better material than a thin one. That is slow, honest work, scored in the best online reputation repair companies.

Reputation Resolutions offers reputation repair services for the search side of a breach or recall. Its pitch: results-based services for repairing, improving and protecting online reputations on Google and AI. Payment is only required after results are achieved. It is A+ BBB Accredited, has been in business since 2013 and serves clients in 40+ countries. Removals typically take 30 to 60 days, and no firm can promise an outcome.

If the event is live now, compare firms in the best crisis management firms for online crises. A smaller company can start from the best crisis communications agencies for startups.

A nonprofit that holds donor data can compare crisis firms for nonprofits and foundations before an incident.

What a Crisis Communication Plan Should Contain

A plan is a short document that names people, lists audiences and holds draft statements. It should fit on a few pages and be rehearsed.

• Named response team with phone numbers, including counsel and your insurer
• One spokesperson and one backup
• A list of audiences: regulators, customers, staff, partners, reporters and investors
• The notification clocks that apply to your business, with who owns each
• Holding statements for a breach, a recall and a service outage, ready to adapt
• One web page template for updates, with a place to host it that will not fail in the event
• A search and social media check, and who does it, each day during an incident
• A yearly rehearsal and an update after each real event

A firm that holds client files can also check reputation management companies for law firms before an incident.

Reviewed by

Anthony Will

Founder and CEO, Reputation Resolutions

Anthony Will founded Reputation Resolutions, the publisher of this site, and has worked in online reputation management since 2013. He reviews the methodology and every scoring change.

How we score Our disclosure Editorial standards