Empathy and action: An organization’s responsibility following a data leak

The UK's Information Commissioner’s Office (ICO) recently highlighted the critical need for organizations to deliver better support to those affected by data breaches: 

“There are two important things I need organisations to understand: empathy and action. You have a role to stop the negative ripple effect in someone’s life from spreading further. It is vitally important to acknowledge what has happened, be human in your response and commit to making sure it doesn’t happen again. We trust organisations with some of the most sensitive personal information imaginable, yet these data breaches continue to happen. This is not just an admin error – it is about people. When data is mishandled, it can have serious and long-lasting consequences, particularly for people in vulnerable situations. We need organisations across the country to do better.” - John Edwards, Information Commissioner 

The average cost of an incident today stands at 4.88 million US dollars, an increase from 4.35 million in 2022. However, all too often we neglect to consider the other costs to those impacted by a data breach, from financial losses to severe emotional impact. Figures revealed by the ICO show that:  

• Nearly 30 million people in the UK have experienced a data breach
• 55% of UK adults reported having had their data lost or stolen
• 30% of them experienced emotional distress as a result
• 25% said they received no support from the organizations responsible
• 32% found out through the media rather than from the organization itself  

The ICO has called for organizations to better support those impacted by data breaches by demonstrating empathy, transparency, and providing real-time guidance on necessary steps after a breach occurs. This approach fosters trust and acknowledges the often profound impact that a data breach can have on individuals. 

However, the importance of a preventive stance cannot be overstated. Organizations have a moral and legal obligation to take all reasonable steps to safeguard data, both as an operational standard and as a preventive measure to avoid the fallout of data breaches. Across the globe, data protection regulations (such as HIPAA, DORA, and NIS2) are evolving to increase the responsibilities on organizations to protect data in email, placing greater emphasis on advanced encryption, multi factor authentication controls, data loss prevention tools, and even proof of delivery.