A customer reads about a data breach elsewhere and asks whether their details are safe with you. It is a reasonable question. ‘We take security very seriously’ is not much of an answer.
Good email security reassurance explains what you know, what the customer needs to do and where they can get a reliable answer. It avoids the comforting promises that fall apart as soon as someone asks a follow-up question.
Find out what the customer is worried about
Are they asking how you protect their details? Have they received a suspicious message using your name? Or are they reporting something that may be a genuine security incident?
Those situations need different responses. Start by clarifying the concern and passing technical questions to the person responsible for security. Customer support should not have to improvise an account of your systems.
If a customer reports a suspicious email, use your established reporting process. Do not ask them to click a link or open an attachment to prove what they received.
Use facts you can stand behind
Explain relevant safeguards in language the customer understands, but only where those safeguards have been verified. Describe what happens to a reported concern and where customers can find your privacy information.
Avoid claims such as ‘completely secure’, ‘impossible to hack’ or ‘nothing can ever go wrong’. No responsible business can offer that assurance. Equally, do not publish technical details that would help someone target your systems.
- Say who can answer the customer’s question.
- Explain the relevant process, rather than listing impressive-sounding technology.
- State what is still being checked.
- Give a realistic time for the next update if one is needed.
Reassurance works when the facts can carry the weight.
Keep routine reassurance separate from an incident
A report about another company is not a reason to send a dramatic warning to your entire list. An alarming subject line can create concern where there was none.
If your own business may be affected, however, stop treating the matter as an ordinary marketing question. Follow your incident-response process and establish what is known. Do not send a blanket ‘all clear’ while the investigation is still unresolved.
Personal data breaches may trigger legal notification duties. Under the UK GDPR, notifiable breaches must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness. Where a breach is likely to create a high risk to people’s rights and freedoms, affected individuals must also be told without undue delay. These are different thresholds, not one universal deadline for every message.
Get appropriate legal and security advice. A reassuring campaign cannot replace a required notification.
Give customers a safe way to act
A security message should not resemble the phishing email you want people to avoid. Use a recognisable sender and established contact routes. Do not ask readers to reply with passwords, payment details or one-time codes.
Where relevant, explain how to reach an account or support page independently through your usual website. Make it clear whether the customer needs to do anything, and distinguish essential action from optional advice.
Keep promotions out of the message. A customer asking about their personal information does not need a discount code before they receive an answer.
Give your team a response structure
Prepare a short internal checklist rather than a universal ‘your data is safe’ template:
- What question or event are we responding to?
- Which facts have been confirmed, and by whom?
- What does this mean for the particular customer?
- Is there any action they need to take?
- Where can they ask questions, and when will we update them?
Have the responsible person approve any technical or legal claims. Record what was sent so the next colleague can give a consistent answer.
For a genuine incident, our guide to the first steps after a data breach provides a starting point for thinking about the response, alongside current specialist advice.
Your next move: replace one vague security promise in your standard reply with a clear, verified explanation of what your business actually does.
The WizEmail Team
