In 2022, McKinsey published a report on establishing durable data ethics practices. According to the report’s authors, organizations with such practices benefit from several advantages, such as increased stakeholder trust and faster decision-making through clear risk thresholds for employees and standard criteria for determining acceptable data ventures. The report suggests these benefits are both defensive (preventing problems) and proactive (creating opportunities). It emphasizes that data ethics requires organization-wide commitment, clear governance structures, and integration into daily operations. It also highlights how establishing, strengthening, and maintaining stakeholder trust requires companies to go beyond regulatory compliance. There’s no reputational reward for meeting the bare minimum.

However, the report also identifies several challenges preventing organizations from adopting data ethics practices, including:

1. Assuming data ethics doesn't apply to their organization
2. Relegating data ethics solely to legal/compliance teams
3. Prioritizing short-term ROI over long-term considerations
4. Focusing only on data utility without considering sources and implications

These challenges are even more critical when considering their impact on incident response capabilities because while organizations often treat ethics and incident response as separate domains, the reality is that they're deeply interconnected. An organization's ethical framework - or lack thereof - directly shapes its ability to respond how it wants to when incidents occur. A company that has already grappled with ethical data usage and established clear principles is better positioned to make difficult decisions during an active incident. This natural connection between ethics and incident response deserves closer examination.

The Data Ethics-Incident Response Connection

After 20 years in the field, I can’t ignore the intersection of data ethics and incident response readiness. I’ve seen how an organization's functioning values and principles can either strengthen or undermine its resilience. Below are several ways data ethics and incident resilience connect and reinforce each other.

• Transparency and Trust — Ethical data practices foster transparency and build confidence in an organization’s ability to handle incidents and recover for the better. Generally speaking, organizations prioritizing data ethics also maintain meticulous documentation and well-defined data flows, enabling them to assess and respond to incidents quickly and decisively.  Moreover, establishing a history of transparent practices supports the credibility of your incident communications because your past actions align with your message. Without alignment between actions and communication, trust and understanding is difficult to earn from stakeholders, making them less likely to accept your explanations. 
• Data Governance and Incident Response — Clear governance structures – supported by strong, articulated, and exercised data ethics – can significantly enhance incident response capabilities. If better monitoring and controls help organizations detect and contain incidents faster, consider how a clear understanding of data assets and their criticality — proven with accurate data maps — allows for quicker impact assessments and informed decision-making, resulting in a more efficient and effective response. 
• Policy and Procedure Alignment — Several key aspects can help you seamlessly integrate ethical data decisions into incident response procedures, such as clear data classification guidelines which can inform and streamline priorities during an incident. Well-defined roles and responsibilities for making and implementing data ethics decisions can also be used for incident response. When working with Discernible clients on their RACI models for incident response communications, we find that the roles and responsibilities often mirror those related to data practices outside of incidents. Formally acknowledging and documenting that alignment is valuable because predetermined communication protocols can facilitate timely and transparent communication when under pressure. Misalignment in practice or understanding is a big red flag for folks tasked with explaining decisions to stakeholders. One of these reasons we believe incident response procedures should reflect daily operations as much as possible is that we’ve found that frequent, not only regular testing and validation processes are fundamental to ethical data practices and incident response preparedness. Finally, consider how post-incident analysis can improve both incident response effectiveness and ethical data practices to prevent or reduce the impact of various security and privacy events. I previously published a list of sample questions I’ve used with engineering and product teams to evaluate whether a change in the company’s data practices was likely to create what I call “privacy outrage.” Not all incidents are inevitable; and we do ourselves, our organizations, and our stakeholders a grave disservice by ignoring these considerations until an incident is triggered. 
• Stakeholder Management— Proactive ethical data practices foster strong relationships across stakeholders, from customers and regulators to employees, investors, and industry partners. Having a reputation for data ethics and open communication is an invaluable source of goodwill and benefit of the doubt when you need it the most. If you don’t already have clear and established communication channels for every audience (including backups), doing so now will enable swift and effective engagement when things go south. Maintaining ethical data practices also helps build trust with media contacts, helping incident communications land with credibility and understanding. Your ethical behavior extends to vendor and partner relationships (an often overlooked audience in traditional incident communications), fostering a network of trust and collaboration you can leverage during an incident. A strong foundation of ethical behavior also cultivates a more engaged employee base, who are more likely to be supportive and cooperative during incident response efforts. 

Integrating Data Ethics into Incident Response Planning

Below are some initial steps organizations can take to proactively weave data ethics into their incident response framework to respond effectively to maintain stakeholder trust and uphold their core values. 

• Planning for Principled Response — Start by integrating ethical decision-making frameworks directly into your incident response plans. Then, create scenario plans that specifically address potential ethical dilemmas to help teams prepare for navigating complex situations. Again, the more often you follow this framework in your day-to-day operations, the more familiar it will be when running it during an incident. For example, clear ethical guidelines for incident disclosure, from bug bounty reports to third-party supply chain attacks, promote transparency and accountability. They also help establish protocols for protecting impacted populations during incidents, which is not only the right thing to do ethically, but also demonstrates a commitment to your stakeholders. Incident response plans can also prioritize actions that align with organizational values and minimize harm by building ethical considerations into triage, mitigation, and communication processes. 
• Strengthen Documentation and Training — Robust documentation and comprehensive training are vital for integrating ethical considerations into incident response, not simply in theory but in practice. Integrated training programs covering ethics and incident response together help all team members understand their roles and responsibilities in helping the organization make ethical decisions. Maintaining updated stakeholder maps and communication plans ensures that relevant parties are informed and engaged throughout the incident – and beyond. Furthermore, documenting ethical decision-making processes for high-pressure situations provides guidance when time is of the essence. Regular testing and simulation of ethically complex scenarios allow teams to practice their responses and refine their decision-making skills.
• Build Cross-functional Capabilities — We run many messaging focus groups at Discernible, and almost universally, security practitioners respond poorly to the term “collaboration” because it sounds much more complicated and challenging than doing something yourself. We’re telling on ourselves here, fam. We can’t simultaneously hope for “shared responsibility” and refuse to develop the necessary skills and relationships to achieve that outcome. Effective incident response requires collaboration across multiple functions and should include ethics expertise across functions, ensuring that ethical concerns are considered at every stage of your response. Don’t forget to include clear escalation paths for ethical concerns to promptly resolve complex issues that might pop up during an incident.

Shared metrics for success are another essential element because they foster a culture of collective accountability and allow for ongoing performance evaluation as an organization. The goal here is continuous coordination to simultaneously consider privacy, security, and ethical concerns and promote a holistic approach to both data management and incident response.

• Enhance Monitoring and Assessment — It’s no secret that continuous monitoring and assessment are essential for maintaining both ethical data practices and effective incident response because we can’t manage what we don’t measure. Moreover, policies are only as good as their enforcement. Implementing monitoring systems that cover security and ethical concerns allows organizations to proactively identify and address potential risks before they become or exacerbate an incident. Regularly evaluate whether the ethical risks in your incident response procedures reflect your organizational values. When working with clients on incident readiness, our team starts with the values and attributes the organization wants to exemplify in their response behavior. This approach puts everyone on the same page regarding tone, language, and transparency of their communications before a single word is written or said. 
• Strengthen External Relationships — Most traditional incident communications plans don’t consider connections with peer organizations or advocacy groups. I believe this is a missed opportunity for information sharing and learning from each other’s experiences. Creating a network of mutual support provides a safety net during incidents and allows organizations to leverage the collective expertise and credibility of the community.

The key to effective integration is recognizing that strong data ethics create a foundation for more effective incident response, while good incident response practices help maintain ethical standards under pressure. Each reinforces and strengthens the other, creating a more resilient organization overall. We must understand this intersection as our organizations face dramatically complex incidents that require balancing multiple stakeholder interests while maintaining public trust. Organizations proactively addressing this intersection are better positioned to handle future challenges effectively.