# Crisis communications: customers, regulators, media, insurers URL: https://insurancelawestonia.ee/specialty-lines/handbook/crisis-communications/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-12 > Communicating during an incident with customers, regulators and the media without prejudicing liability, fines or insurance cover in Estonia. > **In short.** Crisis communication is not merely a reputational matter but a legal and strategic activity. Wrong or late communication can increase the loss, give rise to additional claims and weaken the company's position towards the supervisory authority and the insurer. The same principle applies in every direction: information must be accurate, timely and consistent with the company's legal strategy.[^1] For insurers, the chapter matters twice: statements made by the insured can prejudice the defence of liability claims and the insurer's recovery, and crisis communication costs are often themselves part of the cyber cover. ## 1. Customers Customers are often the party most directly affected in a crisis. Their trust determines the company's long-term viability and often also whether the crisis escalates into litigation. The central question is **what to disclose and when**. Information that comes too early and is inaccurate creates confusion, while delay leads to a loss of trust and to additional claims. In the event of a data breach, a statutory duty may arise to inform the data subjects of the nature of the breach, its likely consequences and the measures taken, and to give them guidance on what to do ([General Data Protection Regulation (GDPR) art 34(1)–(2) and recital 86](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679)). **Example.** A company discovers a leak of customer data but decides to wait until the extent is clear. In the meantime, customers learn of the leak elsewhere and react negatively. They later argue that the company breached its duty to inform and increased their loss, because they could not block their cards or change their passwords in time. Customer communication must be: - clear and understandable; - honest, not speculative; - consistent with the legal assessment. Every communication may later be evidence. Assumptions ("the attack came from Russia"), premature admissions of liability ("it was our fault") and contradictory messages to different audiences must therefore be avoided. ## 2. Supervisory authorities Communication with supervisory authorities is in many cases a statutory duty, not a voluntary choice. - **Data Protection Inspectorate** (*Andmekaitse Inspektsioon*, AKI): the controller must notify a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification must be accompanied by the reasons for the delay, and a processor notifies the controller without undue delay (GDPR art 33(1)–(2)).[^2] The notification contains a description of the breach, the categories and approximate number of the data subjects and records concerned, the likely consequences and the measures taken or proposed. - **Information System Authority** (*Riigi Infosüsteemi Amet*, RIA): within the scope of the Cybersecurity Act (*küberturvalisuse seadus*, KüTS), for a cyber incident with a significant impact (or where such impact can reasonably be expected), an initial notification without delay and at the latest within 24 hours and an incident notification within 72 hours, an interim report on RIA's request, and a final report within one month of the incident notification; if the incident has not been resolved by then, the report is treated as an interim report and a new final report is submitted within one month of resolution (KüTS § 8 lg 4³ and 7).[^3] - **Financial Supervision Authority** (*Finantsinspektsioon*): companies in the financial sector have their own notification duties; insurers must report major ICT-related incidents to the Financial Supervision Authority and to RIA in accordance with article 19 of Regulation (EU) 2022/2554 (DORA) (Insurance Activities Act (*kindlustustegevuse seadus*, KindlTS) § 105¹).[^4] - **Police**: a criminal complaint in cases of fraud and cybercrime. The supervisory authority assesses how quickly the company responded, whether the measures were adequate and whether the board performed its duties. Notification is not a formality. **Example.** A company provides the supervisory authority with incomplete information that later turns out to be wrong. This may lead to a stricter sanction, because in addition to the infringement itself the quality of the cooperation and communication is assessed. For a breach of the Cybersecurity Act, the fine for an essential entity can reach EUR 10 million or 2% of the worldwide annual turnover, whichever is higher (KüTS § 18²).[^3] Communication with the supervisory authority also affects the D&O risk (the board's conduct is assessed) and insurance cover (if the policy covers the costs of regulatory proceedings, it may require the insurer to be notified before replies are given). Communication must be accurate, checked, timely and coordinated with the lawyer. ## 3. Media Media communication is unavoidable if the incident affects the wider public. The media shape public opinion, which influences customer behaviour, investor confidence and the attention of supervisors. The main risk is **losing control of the narrative**. If the company does not communicate, others fill the information gap: customers, employees, competitors or the attackers themselves (ransomware groups often publish leaked data on their sites). **Example.** A cyber incident becomes public before the company is ready to respond. The coverage is speculative and negative. Later communication fails to restore trust. Good media communication requires: - a single, clear message; - a designated spokesperson (other employees do not comment); - cooperation with a PR specialist who knows crisis situations. A balance must be struck between transparency and legal protection. Excessive openness may lead to the disclosure of information that is later used against the company; excessive reticence creates suspicion and deepens the crisis. ## 4. Communication and insurance Communication directly affects insurance cover. - **Admission of liability.** Liability policies usually prohibit acknowledging or satisfying a third-party claim without the insurer's consent. The exact effect of such a term depends on the policy and the law (an agreement releasing the insurer is void where refusing to satisfy or acknowledge the claim would clearly be contrary to good faith in view of the injured party's interests; VÕS § 515 lg 2), but a public admission of fault in any event makes both the insurer's defence and the company's own position more difficult. A third-party claim must be notified to the liability insurer within one week (Law of Obligations Act (*võlaõigusseadus*, VÕS) § 514 lg 1).[^5] - **Settlements.** A settlement with the third party liable for the loss, or a waiver of the claim against the wrongdoer, without the insurer's consent may prejudice the insurer's recovery and release the insurer to the extent that it could have obtained compensation (VÕS § 492 lg 2).[^5] - **Cost cover.** Cyber insurance often covers the costs of crisis communication and PR services if the service provider has been agreed with the insurer. Professional communication is thus also part of the insurance cover. - **A single narrative for the insurers.** Contradictory descriptions given to different insurers, or to the insurer and the media, give grounds for suspicion and disputes. ## 5. Typical mistakes - delaying notification; - contradictory messages to different parties; - speculative or inaccurate information on the origin and extent of the attack; - premature admission of liability; - failing to involve the lawyer or the insurer; - failing to instruct employees (social media posts). These mistakes can lead to greater reputational harm, stricter sanctions and challenges to the insurance claim. Properly managed communication can limit the loss and preserve trust. ## 6. Structure of the messages The first public message (holding statement) must be ready before the crisis and adaptable within a few minutes. Its elements: 1. **What is known**: "On [date] we discovered an incident affecting [systems/services]." Only verified facts. 2. **What we are doing**: "We have isolated the affected systems, engaged external experts and notified the relevant authorities." 3. **What this means for the customer**: which services are not working and what the customer should do (for example, change passwords, be alert to phishing e-mails). 4. **When we will provide new information**: a fixed time for the next update. 5. **Contact**: a single channel for questions. What the message must not contain: speculation about the attacker, statements that "no data leaked" unless this has been verified, admissions of fault, promises to compensate losses. ## 7. Employees and inside information Employees are both a target audience and a risk in a crisis. They need: - short guidance on what to say externally (or an instruction to refer all questions to the spokesperson); - information on how work will continue (substitute processes, contacts); - a warning about possible follow-up attacks (fraudsters exploit the crisis). A listed company must also assess whether the incident is inside information that requires disclosure; this decision must be taken together with the lawyer. ## 8. Communication with the insurer The insurer is an audience in its own right. It is advisable to: - appoint one contact person who communicates with all insurers; - send the same description of the facts to all insurers; - coordinate public messages and letters to third parties with the insurer where the policy requires it or where they may affect the question of liability; - record all agreements and instructions in writing. If the insurer's claims handler gives an oral instruction, it is worth confirming it by e-mail. ## 9. Crisis communication checklist | Step | Question | Responsible | |---|---|---| | 1 | Has a spokesperson been designated, and do the other employees know that they do not comment? | Management board | | 2 | Has the first message been reviewed by the lawyer? | Communications, lawyer | | 3 | Have the statutory notifications (AKI, RIA, Financial Supervision Authority) been made on time? | Lawyer | | 4 | Have customers been informed clearly and with instructions? | Communications | | 5 | Has the insurer been notified and, where necessary, have public messages been coordinated with it? | Lawyer, CFO | | 6 | Is the time of the next update known, and is it being kept? | Communications | | 7 | Have all outgoing messages been archived? | Communications | ## Related pages - [The first 24 to 72 hours](https://insurancelawestonia.ee/specialty-lines/handbook/first-24-72-hours) - [Notification and claims strategy across several policies](https://insurancelawestonia.ee/specialty-lines/handbook/notification-across-policies) - [Kriisisimulatsioonid](https://kindlustusoigus.ee/riskijuhtimine/simulatsioonid/) (crisis simulations, in Estonian) - [Cyber claims in Estonia](https://insurancelawestonia.ee/guides/cyber-claims-estonia) ## References [^1]: O.-J. Luik. Ettevõtte juhtkonna riskiraamat [A risk handbook for company management]. Manuscript, as of 03.05.2026, ch 33. [^2]: Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), art 33(1), (3). OJ L 119, 04.05.2016, p 1–88. . [^3]: Cybersecurity Act (küberturvalisuse seadus, KüTS) § 8, § 18². RT I, 06.10.2026, 2 (in force 16.10.2026). Estonian: ; English (version in force 01.10.2026–15.10.2026): . [^4]: Insurance Activities Act (kindlustustegevuse seadus, KindlTS) § 105¹. RT I, 11.07.2026, 140 (in force 21.07.2026). Estonian: ; English: . [^5]: Law of Obligations Act (võlaõigusseadus, VÕS) § 492 lg 1–2, § 514 lg 1. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: .