What publication-side crises look like
Most journalism training focuses on crises journalists cover. Far less attention is given to crises that happen to the publication itself. Publication-side crises include: factual errors in published stories (ranging from a misquote to a story based on fabricated information), cyber-attacks against the publication's systems, the unauthorised publication of leaked internal materials, data breaches affecting subscriber information, and reputational crises arising from staff conduct.
UK news publishers operate within a regulatory framework that creates specific obligations when things go wrong. IPSO Clause 1(ii) sets out the corrections standard for regulated publishers. UK GDPR and the ICO impose a 72-hour reporting deadline for personal data breaches. The CIPR (Chartered Institute of Public Relations) crisis communications guidance provides a framework applicable to organisations including news publishers.
The characteristic of a crisis is that normal decision-making processes are insufficient. Pre-prepared crisis protocols — tested before a crisis occurs — are essential for an effective response.
Crisis types and initial response priorities
Factual error in a published story
Immediate priority: correct the article with a clearly dated correction note. Assess IPSO Clause 1(ii) due prominence obligations. Update or address social posts that spread the original error. Notify anyone named in the error if appropriate.
Cyber-attack on publication systems
Immediate priority: isolate, contain, and assess. Activate IT incident response. Notify legal and senior management. Assess personal data breach obligations under UK GDPR (72-hour ICO notification if applicable). Issue a staff briefing via out-of-band communications.
Leaked internal materials
Immediate priority: assess scope and legal position. Issue a hold-state public statement. Seek legal advice on whether materials were unlawfully obtained. Do not speculate about origin or scope in initial statements.
Staff conduct crisis
Immediate priority: separate HR response from public communications. Issue a statement that acknowledges the situation without pre-empting investigation outcomes. NUJ representation rights apply for members.
Regulatory ruling (IPSO/IMPRESS)
If a ruling against the publication is upheld, the correction or adjudication must be published with the prominence specified by the regulator. Failure to comply creates a secondary crisis.
Social media pile-on
Distinguish between organised harassment campaigns and legitimate public criticism. Legitimate criticism requires response. Harassment requires staff protection and platform reporting. Do not delete posts that document the harassment.
Red flags to watch for
- No pre-prepared crisis protocol — improvised crisis responses are slower, less consistent, and more likely to make things worse.
- Issuing a public statement before internal facts are confirmed — statements that are later contradicted compound the original crisis.
- Issuing corrections that lack the prominence required by IPSO Clause 1(ii) — insufficient prominence is itself a regulatory breach.
- Failing to brief staff before a public statement is released — staff discovering a crisis publicly rather than internally creates a secondary internal communications problem.
- Deleting social posts that documented an error rather than correcting them — deletion looks evasive and may not remove the content from third-party archives.
- Not having a secure out-of-band communications channel for crisis scenarios — if primary email or Slack is compromised, you need an alternative.
Correction protocol: IPSO Clause 1(ii) in practice
- ›Correct the original article: add a clearly labelled, dated correction note at the top of the article, not at the bottom where it will be missed.
- ›State what was wrong and what is correct: a correction that only says the article has been updated, without explaining the nature of the error, does not meet IPSO standards.
- ›Assess due prominence: the correction must have prominence equivalent to the original error. A front-page story requires a front-page correction or equivalent online prominence.
- ›Address social media: update or add a follow-up to any publication social posts that shared the original article, linking to the correction.
- ›Notify the subject: if the error affected a named individual or organisation, notify them of the correction as a matter of courtesy and to avoid a complaint.
- ›Document the correction process: record what was wrong, when it was corrected, and what prominence was given. This documentation is essential if a formal IPSO complaint is subsequently made.
Social media crisis response strategy
Social media accelerates the spread of both crises and corrections. When a publication-side crisis becomes visible on social media, the response must be coordinated across the web article, the publication's own social accounts, and if appropriate, the social accounts of individual journalists involved.
The CIPR crisis communications framework recommends a hold-state statement for crises where full facts are not yet known: acknowledge that something has occurred, state that the publication is investigating, commit to providing more information by a specified time, and name a single point of contact for media enquiries. Silence is rarely an effective strategy — it is filled by speculation from others.
See also our Ethics & Standards guide for IPSO and IMPRESS regulatory context, and our community engagement guide for managing reader reaction during a crisis.
Common mistakes
- Treating every online criticism as a crisis requiring a public response — not all negative coverage requires a statement; escalation should be proportionate.
- Issuing a public apology before the internal investigation is complete — premature apologies may conflict with legal advice or contradict subsequent findings.
- Sending a single spokesperson into a high-volume social media crisis without support — crisis communications requires a team, not an individual.
- Not testing the crisis protocol before a crisis occurs — tabletop exercises that rehearse different scenario types dramatically improve real crisis response.
- Using the same social media accounts for crisis communications as for normal editorial output — dedicated crisis accounts or protocols prevent mixed messaging.
- Assuming a cyber-attack is not a UK GDPR issue — any breach involving subscriber or staff personal data triggers ICO notification obligations within 72 hours of discovery.
Related guides
Primary sources
- IPSO Editors' Code of Practice (Clause 1)— ipso.co.uk
- IMPRESS Standards Code (Standard 3)— impress.press
- NUJ Code of Conduct— nuj.org.uk
- CIPR Crisis Communications Guidance— cipr.co.uk
- ICO Report a Data Breach (72-hour obligation)— ico.org.uk