Operations
Part of Crisis communications plan for UK SMEs: a step-by-step guide
Crisis communications plan for UK SMEs: a step-by-step guide
A practical crisis communications plan for UK SMEs: scenarios, spokespeople, holding statements and a six-step build you can rehearse in half an hour.
What to take away
- A workable crisis communications plan for a UK SME fits on four pages: scenarios, spokespeople, a sequenced response, and a contact sheet.
- Name one person who approves every holding line, and one deputy, before anything happens.
- Write the first hour as a numbered sequence, not as principles.
- Check the personal data, defamation and director duty angles early, because they shape what you can say.
- Rehearse twice a year with a 30-minute desk exercise.
Start with the incidents your business can actually expect
Most SMEs will never face a national scandal. The plausible list is shorter: a payment outage, a supplier failure, or a fire at one site. Choose four scenarios at most and write each one as a single line.
Four scenarios and their triggers
Scenario
- Payment outage
- Failures pass 30 minutes
- Site fire
- Fire service attends
- Data loss
- Personal data missing or exposed
- Online claim
- A post naming you spreads
Open the plan when
- Payment outage
- Provider, then bank
- Site fire
- Insurer, landlord, staff
- Data loss
- ICO, then customers
- Online claim
- Solicitor, then platform
First call
- Payment outage
- Site fire
- Data loss
- Online claim
Rank the four by likelihood, then by the damage a week of downtime would do. Fund the plan for the top two.
Each scenario needs a trigger sentence. 'Payments have been down for more than two hours and the cause is unknown' tells a duty manager to open the plan. Vague triggers get ignored at 3am.
Incidents your business can expect
| Scenario | Open the plan when | First call |
|---|---|---|
| Payment outage | Card or transfer failures pass 30 minutes | Payment provider, then bank |
| Site fire | Fire service attends | Insurer, landlord, staff |
| Data loss | Personal data is missing or exposed | ICO, then affected customers |
| Online claim | A post naming you is spreading | Solicitor, then the platform |
Who speaks, and who keeps quiet
Name a lead spokesperson and a deputy. For a 20-person firm that is usually the founder plus whoever runs operations. Everyone else declines comment and passes the caller on.
Give the spokesperson three approved sentences they can use before facts are confirmed. A holding statement that says you are investigating, that you will update by a named time, and that gives a direct contact line works for most incidents.
The board still owns the plan. Directors' general duties sit in Part 10 of the Companies Act 2006, so the person signing off the response is accountable for it.
Brief your staff before you brief the press. A one-page note telling them who to direct calls to prevents a junior employee giving a version nobody approved.
Build the plan in six steps
- List your four scenarios and the trigger for each. Keep it to one page.
- Write the contacts sheetstaff, insurers, bank, utilities, IT supplier, and your solicitor. Add out-of-hours numbers.
- Draft three holding statements per scenario, each under 100 words.
- Agree the approval chain. One approver, one deputy, names and mobiles.
- Set the channels. A paused social account is better than a live one nobody is watching, and the UK corporate social media disclosure rules set what you must not say while an account is quiet.
- Book the reviewwho logs decisions, times, and what was said.
UK contacts and protocols worth writing down
For business continuity, your local authority's emergency planning team is the first call after the emergency services. They hold rest centre and road closure information.
If a false claim about your business is published, the Defamation Act 2013 shapes what a court would weigh before you reply in public. Ask your solicitor to read any reply first.
If the incident involves personal data, the Data Protection Act 2018 governs how you handle it. Under UK GDPR, a reportable breach must reach the ICO within 72 hours of you becoming aware of it.
Media protocols are not law. Editors work to their own codes, and the Independent Press Standards Organisation handles complaints about accuracy. A short, accurate statement tends to end a story faster than silence.
Rehearse it, then keep it short
Run a 30-minute desk exercise twice a year. One person reads a scenario aloud; the spokesperson drafts a holding statement on the spot; someone times it. Note what broke.
Change the plan after each exercise. A plan last updated three years ago is a folder, not a plan.
The plan should stay under four pages. Documents that long do not get read under pressure. If you need a structure, the workflow from source authority to controlled exit fits one page per scenario.
Common questions
What should a small business say first in a crisis?
Acknowledge the incident, say what you are doing, and commit to a time for the next update. Do not speculate on cause or blame.
How long should a crisis communications plan be?
Four pages at most. One page of scenarios, one of contacts, one of statements, and one of the approval chain and log.
Do we need to tell the ICO straight away?
Only if the breach is reportable. If personal data has been lost or exposed, the 72-hour clock starts when you become aware, so check the threshold on day one.
Who should approve the holding statement?
The named lead spokesperson or their deputy, plus one director. Two names maximum, or the plan stalls.
