A company is in the middle of an incident, and customer data has been breached. Which of the following should the company contact first?

Contacting the media directly before legal counsel has been involved can lead to premature or inaccurate statements that could exacerbate legal or reputational damage.

Public relations works under the guidance of legal and executive management to craft external communications; they should not be the first contact during a breach.

While law enforcement may need to be notified eventually, especially in cases of criminal activity, legal counsel will guide the timing and manner of such reporting to ensure it aligns with legal obligations and company interests.

When customer data has been breached, contacting the legal department first is crucial because they will advise on regulatory compliance requirements (e.g., GDPR, HIPAA, CCPA), potential liabilities, and necessary disclosure procedures. Legal counsel ensures the company responds in a legally sound manner, minimizing penalties and managing reputational risk effectively.