Don’t Shoot The Messenger: Things to Consider When Deciding Whether and How to “Message” an Incident

When an organization experiences a data security incident, one of the first questions the organization asks is: Who do we have to notify? This question is often followed with two other ones: What do we have to say? And when do we have to say it? From a legal standpoint, applicable statutes, contracts, and regulations often dictate to the answers to these inquiries. But notification is not limited to a legal inquiry. Business considerations, such as maintaining customer relationships and goodwill