Telling the People Affected
The communication organisations most want to avoid, and the one that determines whether the incident becomes a lasting problem.
NOTIFICATION TO AN AFFECTED PERSON
Plain language, sent directly, not buried in an all-staff email
- What happenedIn plain terms, specificallyNot a security incident. What actually occurred
- WhenDate it happened and date you found outIncluding the gap, honestly
- What of yoursThe categories relating to them specificallyNot a general list covering everybody
- Who has itAs far as knownIncluding where it is not known
- What we have doneContainment and remediation, concretelyActions, not intentions
- What you can doSpecific steps, if anyOnly where there is something genuine
- Who to contactA named person, reachableNot a generic inbox
- SorrySaid plainly, earlyOmitting it is noticed more than anything else in the letter
Where a breach is likely to result in a high risk, the people affected must be told. Organisations resist this harder than any other obligation in the subject.
The breach workflow in “Telling the People Affected” is easier to operate when systems, owners and evidence are known in advance. If read the provider overview supports self report bias, its records should sit inside the incident inventory with clear access, retention and escalation rules rather than being treated as an unexplained source of employee data.
Why the resistance is misplaced
The fear is reputational: telling people turns an internal matter into a visible one.
For a separate benchmark relevant to “Telling the People Affected”, consult the Mandiant security resources. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
In practice the damage comes from the delay rather than the disclosure. People find out — from a colleague, from a regulator's published case, from the consequences themselves — and the question then is why they were not told.
An organisation that notified promptly and plainly is in a far stronger position than one that assessed the risk as manageable and was later found to have known for three weeks.
What the notification must contain
The nature of the breach. A contact point. The likely consequences. The measures taken or proposed.
That is the legal minimum and it is not sufficient to be useful.
What makes it useful
Specificity about them. Not a list of all categories involved across everybody, but what of theirs was exposed. A person reading a generic notice cannot tell whether their own health data was in it.
Honesty about the gap. If you found out on the fourth and told them on the ninth, say so. The date will emerge.
Actions rather than intentions. We have done this, not we are committed to reviewing.
Something they can actually do, where there is anything. Where there is nothing, say that rather than inventing advice, because filler advice reads as deflection.
An apology, early and plain. Its absence is the thing people notice and quote.
How to send it
Directly and individually where the numbers allow. An all-staff email about an incident affecting eleven people tells four hundred people something and tells the eleven almost nothing.
Where it must be a general communication, follow it with individual contact for those actually affected.
The conversation after
Somebody will want to talk to a person rather than read a letter. Name somebody who can, and brief them properly.
The organisations that handle this well are the ones where the named contact knows the facts and is permitted to say sorry again.
Why delay does the damage
People find out — from a colleague, from a published case, from the consequences. The question then is why they were not told. An organisation that notified promptly is in a far stronger position than one found to have known for three weeks.
Naming somebody they can speak to
Not a generic inbox. Somebody briefed, reachable, and permitted to apologise again. Organisations that handle this well are the ones where that person knows the facts.
What makes a notification useful
Specificity about them rather than a list covering everybody, honesty about the gap between discovery and telling, actions rather than intentions, and an apology said plainly and early.
Individually, where numbers allow
An all-staff email about an incident affecting eleven people tells four hundred something and tells the eleven almost nothing. Where a general message is unavoidable, follow it with individual contact.
The conversation after the letter
Somebody will want to speak to a person. Name one, brief them properly, and permit them to apologise again — which is what distinguishes the organisations that handle this well.