How should a company communicate during a data breach? Acknowledge the incident within 24 to 48 hours, state what is known, say which data is affected, tell people what to do, and update on a fixed schedule while legal counsel confirms every deadline. IBM's 2026 Cost of a Data Breach Report puts the global average cost at $4.99 million and the U.S. average at $11.5 million.
Last updated October 6, 2026. This guide is communications advice, not legal advice. Confirm every deadline with counsel.
What Should a Breach Statement Include?
A breach statement should give accurate, timely facts and avoid speculation. Include five elements:
- A clear description of the incident.
- The types of data potentially affected.
- The actions taken to address the breach.
- The steps people should take to protect themselves.
- Resources for more information and support.
Capital One's 2019 response is a useful model for the first statement. The company acknowledged the incident quickly, said about 100 million customers were affected, and described the immediate actions it took to secure its systems.
Which Notification Deadlines Apply?
Notification deadlines depend on where the affected people live and what kind of company you are, so identify them on day one. The table lists the rules most breaches trigger.
| Rule | Who it covers | Deadline |
|---|---|---|
| GDPR | Organizations handling personal data of people in the EU | Notify the supervisory authority within 72 hours of becoming aware of the breach |
| California Civil Code 1798.82, as amended by SB 446 | Businesses holding personal information of California residents | Notify residents within 30 calendar days of discovery, effective January 1, 2026. For breaches affecting more than 500 residents, send the Attorney General a sample notice within 15 days of notifying residents |
| SEC Form 8-K, Item 1.05 | Public companies | Report material cybersecurity incidents, in effect since December 18, 2023, within four business days of determining the incident is material |
| Other state laws | Businesses holding data of residents of each state | Many states set limits of 30 to 60 days, and regulated sectors can face shorter ones |
California's earlier standard was notice in "the most expedient time possible and without unreasonable delay," and the 30-day rule above replaces it. California and several other states allow delay when law enforcement asks for it or when the scope of the breach must be determined.
What Does a Breach Communication Timeline Look Like?
A breach communication timeline moves from acknowledgment to detail to ongoing updates. Speed matters, but accuracy matters more. 5W's Crisis Tax study names the first 48 hours as the most critical window for long-term financial outcomes.
| Phase | When | What to communicate |
|---|---|---|
| Initial notification | First 24 to 48 hours | Acknowledge the incident, share known facts, outline immediate actions |
| Follow-up | Days 3 to 7 | More detailed information, investigation progress, protection measures |
| Ongoing updates | Until resolved | Investigation findings, new security measures, remediation progress |
Use several channels at once: direct messages to affected people, a dedicated website page, social updates, a press release, customer service talking points, and an internal note to employees.
Delay costs money as well as trust. IBM's 2026 report found breaches with a lifecycle over 200 days cost $5.65 million on average, against $4.32 million for those contained within 200 days. The average time to identify and contain a breach rose to 247 days.
How Do You Speak to Each Audience?
Give each audience the information it needs to act, in plain language, and keep the message consistent across all of them.
| Audience | What they need | How to deliver it |
|---|---|---|
| Customers | Clear, actionable information | Plain language, specific protection steps, support resources, consistent updates |
| Employees | Their role in the response, how to handle customer questions, security measures, messaging guidelines | An internal briefing before the public statement |
| Media | One accurate source | Designated spokespeople, prepared statements, regular updates, fact sheets |
| Regulators and shareholders | Required disclosures on time | Notices drafted with legal counsel |
Explain technical concepts in simple terms, focus on the details that matter to the reader, and put deeper technical detail in separate documentation. The cybersecurity PR team at 5W handles this balance for technology companies.
How Do You Balance Transparency and Legal Risk?
Work with legal counsel from the first hour so communications meet regulatory requirements without adding liability. Legal review should cover:
- Notification deadlines in each jurisdiction
- Required content in each notice
- Statements that could create extra liability
- Attorney-client privilege where it applies
- A record of every communication decision
For more on how PR and legal teams share this work, read the role of legal counsel in PR crises.
What Do Real Breaches Teach?
Three breaches show how prompt acknowledgment, regular updates, and detailed disclosure shape the response.
| Company | What happened | Lesson |
|---|---|---|
| Capital One, 2019 | Acknowledged the incident quickly, stated the scale, and described immediate security actions | Give a number and an action in the first statement |
| Microsoft, July 2023 | Disclosed a breach affecting email accounts, gave regular updates, offered specific guidance, and stayed open about its investigation | Update as facts emerge |
| Marriott, 2018 | A breach affecting up to 500 million guests. The first communication was prompt but lacked detail, later updates were fuller, and the company opened a dedicated website for guests | Prompt is not enough without detail |
What Support Should Affected People Get?
Affected people should get practical protection and a way to reach someone. Offer credit monitoring, identity theft protection, dedicated support channels, and regular status updates.
How Do You Track and Close Out the Response?
Track the response through media coverage analysis, social monitoring, customer feedback, and stakeholder engagement, and adjust the plan as the data comes in. After the immediate crisis, share lessons learned, document process improvements, update security measures, and keep engaging stakeholders. The crisis PR guide covers templates and response-team structure.
What Are Common Questions About Breach Communication?
How quickly should a company announce a data breach?
Acknowledge the incident within 24 to 48 hours with known facts, and meet legal deadlines such as 72 hours under GDPR and 30 days in California.
What should a data breach notice say?
The incident, the data involved, the actions taken, the steps people should take, and where to get support.
Who should approve breach communications?
The response team, with legal counsel reviewing every notice before release.
How much does a data breach cost?
IBM's 2026 report puts the global average at $4.99 million and the U.S. average at $11.5 million.
Conclusion: What Should You Do Before a Breach Happens?
Write the communication plan, build templates for each scenario, name legal and PR contacts, train spokespeople, and review the plan on a schedule. Every breach is different, so adapt the plan to the facts while keeping transparency and stakeholder support as the core.
5W's crisis communications practice and cybersecurity PR team prepare and run breach response plans, and its PR strategy team builds the stakeholder plan around them.
