Authenticate without further circulation
The first question is simple: what are we really talking about? A capture can show an old document, an incomplete project, an edit or exact information taken out of context. You must preserve the link, the time and the elements useful for the analysis, then have the content verified by authorized people. Internal distribution must remain limited. Repeating a confidential document everywhere to ask if it is true can aggravate its exposure.
A situation log is opened in an authorized environment. Each entry separates the finding, its origin, the confidence level and the person responsible for the verification. An unconfirmed fact should not become a certainty because it has been repeated in several meetings. Security teams and relevant counsel determine how evidence will be preserved.
At the same time, people potentially affected must be identified. A leak on a financial transaction, a reorganization project and a personal data file call for different processing. The presence of several categories of information requires parallel decisions, coordinated within the same system.
Install a cell capable of deciding
The initial unit may bring together a decision-maker, the communications department, the legal department and the functions directly concerned. Security, the data protection officer, human resources or investor relations join the system depending on the nature of the content. A list of participants that is too large slows down arbitrations and increases the risk of uncontrolled circulation.
A holder and a substitute must be appointed for each essential validation. The requested return time, escalation procedure and authoritative version are self-explanatory. The person writing should not have to guess whether a decision maker’s silence constitutes agreement. The report preserves the decision, its time and its conditions of review.
The work is divided into four areas: establishing the facts, protecting people and systems, examining obligations, and communicating. These pathways feed each other. Speaking out should not announce the end of an incident while the operational teams continue their investigation.
Distinguish public message and mandatory notifications
If personal data is concerned, the controller and the data protection officer assess the applicable obligations. The CNIL specifies the conditions for notifying a violation, in particular the 72-hour deadline when notification to the authority is required. This delay does not constitute authorization to wait to take protective measures. [1] (FR)
Regulated information, a contractual obligation and information intended for affected people also follow distinct logics. The fact of having published a press release does not demonstrate that all obligations have been fulfilled. The unit therefore keeps a table of recipients, those responsible, the content required and the deadlines checked with the competent functions.
For financial information, the analysis should use the current framework and the characteristics of the issuer. For social projects, the timetable cannot be deduced from media pressure alone. The role of communication is to ensure the consistency of explanations, in the order of distribution chosen by the authorized officials.
Prepare a hold message that resists changing facts
A useful waiting message indicates the actually known perimeter, the verifications or measures undertaken and the way in which new information will be given. He avoids denying without proof, attributing the origin of the leak to a person or promising an investigation result. The time of the next information should only be announced if the team can keep this meeting, even to explain that the investigation is continuing.
Here is a fictitious framework, to be adapted and validated: “We have become aware of the distribution of a document presented as internal. Its content and context are subject to verification. Competent teams are mobilized. We will share confirmed information about affected individuals or activities through appropriate channels. » It can only be used if each of these statements corresponds to the real situation.
This wording may be insufficient when a danger is established or an obligation requires precise information. The message must then give the necessary instructions. The company does not benefit from protecting its announcement schedule at the expense of the people who need to act.
| Sequence | Question to be resolved | Trace to keep |
|---|---|---|
| Qualification | Is the content authentic, current and complete? | Source, time and checks |
| Protection | Who can be harmed and what action is possible? | Decided and responsible measures |
| Arbitration | What should be communicated, notified or corrected? | Reasoned decision and validation |
| Broadcast | Do all contacts have the same version? | Messages dated and recipients |
| Reassessment | What new fact changes our response? | Next review and escalation thresholds |
Prepare managers, salespeople and spokespersons
The central cell only receives some of the questions. The exposed functions must be given a short answer, a clear limit and an escalation channel. Managers should not speculate on jobs; salespeople must not promise continuity that has not been verified; spokespersons should not perform a piece whose authenticity remains uncertain.
A common summary may contain the confirmed facts, the questions still open and the formulations withdrawn. Removing an old argument is as important as adding a new one: teams need to know that a previously allowed answer is no longer valid.
After the acute phase, feedback examines the circulation of facts, decision times, public contradictions and the effects on people. It completes the investigation into the origin of the leak without replacing it. Crisis preparation and a sensitive announcement grid make it possible to test these mechanisms before a leak puts them to the test. [1] [2]
Sources and benchmarks
Sources consulted on October 7, 2026. Fictional examples are noted in the text; the analyzes and methods proposed are those of Belief System.
- CNIL specifies the conditions for notification of a violation [1] (FR)