Data Breach Notification

Data breach notification can present various layers of complexity for your organization. Not only do you have to ensure impacted individuals receive critical information about your data breach event, you should also consider ways to protect your brand and reputation by providing an appropriate level of assistance to those affected.

The art of crafting a notification letter is one that can sometimes be taken for granted. Yet, a notification letter is your primary communication with stakeholders regarding your data security incident, making it significant factor in controlling your message and quelling breach population fears. There are many nuances, but any good letter will include some basic information:

• All notification letters, within the confines of what’s allowed by local law, contain some explanation of the event. Of course, what happened may not be uniform across an entire population–a breach may have distinct recipient populations requiring different letters. This could be based not only upon what was lost or exposed for each group, but also demographic makeup or regulatory requirements.
• Contact information will direct individuals to Kroll's call center or another designated source for further information about the breach or identity theft threat that may be present.
• An organization may choose to include information on what steps are being taken to protect stakeholders’ sensitive information. This may also include information on identity monitoring services that are being provided to the impacted population.

Once the letter is drafted, Kroll will assist with the logistics of mailing and preparing for responses from your impacted population. We will work closely with your team to optimize speed and deliverability, while also reducing unnecessary notification costs. Kroll’s team can work with you to:

• Standardize and scrub your mailing list for optimal delivery
• Eliminate duplicate entries
• Provide comprehensive reports that demonstrate and document your best effort to notify and serve those affected by your event
• Manage returned mail

Once this is completed, we can review your mailing list and separate the groups that require special handling, such as: children, adults, expatriates or deceased. We can separate these categories, identifying which individuals might have special considerations for consumer services, or groups that are at a higher risk based on information lost.