loading_
In a crisis, clear communication is essential. Fill in the details of an incident to generate a first draft of a customer notification email.
Provide as much detail as possible for a more accurate draft.
It drafts a customer breach notification: a subject line and a complete email covering what happened, what information was involved, what you are doing about it and what the recipient should do. The tone is direct and plain, avoiding both panic and the evasive corporate register that makes people angrier.
If you are using this during a live incident, you are under time pressure and the words matter. It gives you something to edit rather than something to compose.
Check the regulatory clock first
Under UK GDPR you have 72 hours from becoming aware of a personal data breach to notify the ICO where the criteria are met. Notifying individuals is a separate test. Establish where you stand before you send anything.
Have it reviewed by someone qualified
This is a draft, not advice. A data protection or legal adviser should see it before it goes out, because the wording carries regulatory and contractual weight.
Say only what you know
The strongest notifications are specific about what is confirmed and honest about what is still under investigation. Speculation that later proves wrong is far more damaging than saying the picture is incomplete.
Prepare for the replies
A notification generates inbound questions. Decide who answers them, on what channel, and what they are authorised to say, before the email is sent.
It cannot assess whether you are legally required to notify, when your awareness clock started, or what your sector regulator expects. It does not know your contractual notification obligations to customers or partners. It writes the words; the judgement about whether, when and to whom remains yours and your advisers’.
Under UK GDPR you must notify the ICO without undue delay and within 72 hours of becoming aware of a personal data breach, where it is likely to result in a risk to people’s rights and freedoms. If the risk is high, you must also inform the affected individuals without undue delay. Establishing exactly when awareness began is a judgement call and is frequently where organisations get into difficulty.
Usually earlier than instinct suggests. Certainty arrives days later, and customers, staff and journalists fill the silence long before that. Say what is confirmed, acknowledge what is still under investigation, and commit to a follow-up. Speculation that later proves wrong does more damage than admitting an incomplete picture.
No. It is a communications starting point, not legal advice, and it cannot assess your specific obligations. Have a data protection or legal adviser review any notification before it is sent.
No. The draft is generated and shown in your browser only. Nothing you enter about the incident is stored or transmitted to us, which matters particularly for this tool because the input is sensitive by nature.