If the breach is likely to result in a high risk, you must also inform the people affected without undue delay. The message should be clear and practical: what happened, what it means and what they can do.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Use plain language
- Give concrete steps people can take
- Provide a contact point for questions
Next steps
Prepare template messages in advance. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.