South Africa, Oct. 22 -- Most firms have no crisis plan, for an understandable reason: nothing has gone wrong yet. Then, on a Friday afternoon, the IT provider reports a breach. Or a senior director resigns and takes a team. Or a journalist calls about a client matter.

The firm finds itself making its most important communication decisions in its worst possible hours.

Three bad days you can see coming

The data breach: Firms hold exactly what attackers want: identity documents, financial records, details of deals that have not been announced.

Under the Protection of Personal Information Act (PoPIA), a firm that has reasonable grounds to believe personal information has been compromised must notify the Information Regulator and the peop...