Is it better to disclose past security incidents to customers?

Often yes, and sometimes you must. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., people must be told about a personal data breach that is likely to result in a high risk to them, NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. can require you to inform the recipients of your services about significant incidents, and contracts often add notification duties of their own. Beyond what is required, disclosure is a business decision: customers who learn of an incident from a journalist or a leak site rarely forgive the silence, while a clear account of what happened and what you changed can strengthen trust. Agree a disclosure line with management, legal advice and your insurer before an incident, not during one. Keep the facts ready: when it started, what was affected and what was done.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on For the board and financeAll topics