Crisis Communication Plan for Indian Businesses: Step by Step
A step-by-step crisis communication plan for Indian SMEs, with holding statement templates, a social media playbook and the legal timelines to know.
A crisis communication plan tells your team exactly who speaks, what they say and how fast, when something goes wrong: a product defect, a viral complaint, a data leak, an accident at a factory or an angry video from a customer. This guide gives Indian small and mid-sized businesses a step-by-step plan they can write in an afternoon, ready-to-edit holding statements, a social media playbook, and the legal timelines that apply to complaints and cyber incidents in India.
Key Takeaways
- Decide before a crisis who is on the response team, who is the single spokesperson and who approves statements. Write it down with phone numbers.
- Aim to put out a short holding statement within the first hour or two: acknowledge, show concern, say what you are doing and when you will update.
- Know the legal clocks: CERT-In expects specified cyber incidents to be reported within 6 hours, and e-commerce sellers must acknowledge consumer complaints within 48 hours.
- Move angry customers from public comments to a private channel quickly, but never delete genuine complaints.
- After the crisis, review what happened and update the plan. Most businesses skip this step.
What counts as a crisis for a small business
A crisis is any event that can seriously damage customer trust, safety, revenue or legal standing if it is handled badly. For a large company it may be a national recall. For a small business it can be smaller but just as damaging locally. Typical examples in India:
- A customer posts a video of a foreign object in food from your restaurant or cloud kitchen.
- A batch of your D2C skincare product causes reactions and complaints start trending.
- Customer data such as phone numbers and addresses leaks from your website or a vendor.
- An accident or fire at your factory or warehouse.
- A senior employee’s offensive post goes viral with your company’s name attached.
- Delivery failures during a festive sale lead to hundreds of angry comments.
- A fake notice or deepfake video claiming to be from your company circulates on WhatsApp.
Not every negative review is a crisis. A useful test: is it spreading quickly, does it involve safety, law or data, or could it affect many customers at once? If yes to any, activate the plan.
Step 1: Build your crisis team and chain of command
In a small company, the crisis team may be three or four people. What matters is that roles are clear before anything happens.
| Role | Who (example) | Responsibility |
|---|---|---|
| Crisis lead | Founder or CEO | Final decisions and approval of all public statements |
| Spokesperson | Founder or a trained senior manager | The only person who speaks to media and posts official updates |
| Operations lead | Plant, kitchen or operations head | Fixing the actual problem; providing facts |
| Customer care lead | Support manager | Complaints, refunds, direct messages, helpline |
| Social media lead | Marketing executive | Monitoring, posting approved updates, moderating |
| Legal and compliance | External lawyer or CA on call | Checking statements, regulatory reporting, notices |
| Tech lead (for data issues) | CTO or IT vendor | Containment, logs, CERT-In and other reports |
Put names, mobile numbers and a backup for each role on one page. Keep a printed copy and a copy outside your company systems, because an IT outage or hack may lock you out of shared drives. Create a WhatsApp or Signal group for the crisis team now, not during the crisis.
Step 2: Map your likely scenarios
You cannot plan for everything, but you can plan for the five or six crises most likely in your business. For each, note the first actions and who owns them.
| Scenario | First 60 minutes | Owner |
|---|---|---|
| Product safety complaint going viral | Pull the affected batch from sale, contact the customer, preserve samples, draft holding statement | Operations and crisis lead |
| Customer data leak | Contain the breach, preserve logs, assess what data was exposed, check reporting duties | Tech lead and legal |
| Workplace accident | Medical help and safety first, inform authorities as required, inform families, then communicate | Operations lead |
| Offensive post by an employee | Verify facts, take a decision on action, issue a short statement of values | Crisis lead and HR |
| Mass delivery or service failure | Fix capacity, publish a clear update with a timeline and remedy | Operations and customer care |
| Fake notice or impersonation | Publish a clarification on official channels, report the fake accounts, file a police or cybercrime complaint if needed | Social media lead and legal |
Step 3: Know the legal timelines that apply in India
Communication and compliance run side by side. Some obligations have fixed clocks, and missing them can make a bad situation worse. Rules change, so confirm the current position with your lawyer or the official source.
Cyber incidents: CERT-In’s 6-hour rule
CERT-In’s directions of 28 April 2022, issued under Section 70B of the IT Act, require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within 6 hours of noticing them or being told about them. The directions list the incident types covered, which include data breaches and data leaks, and ask organisations to keep ICT system logs for a rolling 180 days within India. Read the CERT-In directions with your IT team so everyone knows the reporting email and phone number before anything happens.
Personal data breaches under the DPDP framework
The Digital Personal Data Protection Rules, 2025 were notified in November 2025. They set out a two-stage breach notification: inform affected individuals and the Data Protection Board without delay, and give the Board a detailed report within 72 hours. According to MediaNama’s explainer on the DPDP breach timeline, these breach provisions take effect 18 months after notification, which points to around May 2027. Build the process now so you are ready.
Consumer complaints and e-commerce
The Consumer Protection (E-Commerce) Rules, 2020 require e-commerce entities, and sellers on marketplaces, to have a grievance officer who acknowledges a consumer complaint within 48 hours and redresses it within one month. Customers can also go to the National Consumer Helpline (call 1915, or use the website, app or WhatsApp). Companies that join the helpline’s Convergence programme receive complaints in real time and are expected to respond within 30 days. If a complaint about you is rising on social media, check whether it has also been filed there.
Step 4: Prepare holding statements in advance
A holding statement is a short first response you publish before you have all the facts. Its job is to show you know about the issue, you care, and you are acting. It buys time for the investigation without leaving a silence that others fill with speculation.
The four parts of a holding statement
- Acknowledge the issue in plain words.
- Show concern for the people affected.
- State the action you are taking now.
- Promise an update with a specific time.
Template: product complaint
We have seen the video shared by a customer about [product] bought on [date]. We are sorry for the distress this has caused. We have contacted the customer, stopped sale of the batch involved as a precaution, and started a full check at our kitchen and supplier. We will share what we find by [time/date]. Anyone with a concern about this batch can reach us at [phone/email].
Template: service outage or delivery failure
Many of you have not received orders placed during [sale/period], and we understand how frustrating this is, especially before [festival]. The delay was caused by [brief, factual reason]. We have [action taken]. Every affected order will be delivered by [date] or refunded in full if you prefer. We will post the next update here at [time].
Template: suspected data incident
We are investigating a security incident that may have affected some customer information. We have secured the affected system and are working with security experts. We are informing the relevant authorities as required. We will contact affected customers directly with details and steps they can take. Please be careful of calls or messages asking for OTPs or passwords in our name; we will never ask for these.
Replace every bracket with facts. Do not speculate about causes, blame customers or name suppliers before the investigation is done. Avoid “no comment”; it sounds like you are hiding something.
Step 5: Handle social media and WhatsApp
In India, a crisis often starts on Instagram, X or in WhatsApp groups before any journalist calls. The first hours on social media matter most.
- Monitor: search your brand name, product names and common misspellings on each platform daily, and more often during a crisis.
- Pause scheduled posts. A cheerful festive offer going out while customers are angry looks tone-deaf.
- Post one official update and pin it to your profile. Link to it in replies rather than writing a different explanation each time.
- Reply to genuine complaints publicly once, then move the conversation to DMs, phone or email to collect order details.
- Do not delete genuine criticism. Screenshots last forever, and deletion becomes the next story. Hide or report only abusive or spam comments, in line with platform rules.
- Answer in the customer’s language. If complaints come in Hindi, Tamil or Bengali, reply in that language.
- Correct misinformation calmly, with facts and, where possible, evidence such as lab reports or photos.
- For WhatsApp rumours, publish a clear clarification image with your logo, date and official contact details that people can forward, and post it on your website and social profiles.
Step 6: Deal with media calls
When reporters call, they are usually on deadline. Route every call to the spokesperson. Other staff should say: “I will ask our spokesperson to call you back within the hour. May I have your name, publication and deadline?” Then make sure that call happens.
The spokesperson should prepare three key messages, speak only about confirmed facts, and never say anything “off the record” that they would not want printed. If you do not know an answer, say so and promise to find out. If the crisis is serious and ongoing, a short written statement emailed to media, sometimes issued as a formal press release, keeps the message consistent across outlets.
Step 7: Communicate inside the company
Employees hear about a crisis at the same time as customers, often from their own social feeds. Tell them first, or at least at the same time as the public. Share the official statement, explain who is allowed to speak externally, and ask them not to comment on social media or in customer groups. Delivery staff, store staff and call centre agents need a short script for what to say when customers ask.
Step 8: Recover and review
When the immediate crisis passes, close the loop publicly. Share what you found, what you fixed and what changes you have made. For example, a cloud kitchen might announce a new supplier audit process and share photos of the upgraded kitchen. Contact affected customers personally with the remedy you promised.
Then hold an internal review within two weeks:
- What happened, hour by hour?
- How quickly did we detect it, and how quickly did we respond?
- Did the right people have the right information?
- Which messages worked and which caused more anger?
- What should change in the plan, the team list or the templates?
Update the document and run a short drill every six months. A 30-minute tabletop exercise, where the team talks through a made-up scenario, is enough to find gaps.
Frequently Asked Questions
How fast should a business respond publicly to a crisis?
Aim for a short holding statement within the first hour or two, even if you do not have all the facts. Long silence lets rumours and angry posts define the story.
Should a small business apologise immediately?
You can express regret for the customer’s experience straight away without admitting legal fault on unverified facts. Once facts are clear and you were at fault, a direct apology with a remedy works best. Check wording with a lawyer if legal claims are likely.
Do I have to report a data leak in India?
CERT-In’s 2022 directions require specified cyber incidents, including data breaches and leaks, to be reported within 6 hours. The DPDP Rules add breach notification duties to individuals and the Data Protection Board as those provisions take effect. Confirm your obligations with a legal adviser.
Can I delete negative comments during a crisis?
Do not delete genuine complaints. It usually makes things worse. You can hide or report comments that are abusive, spam or break platform rules.
Who should be the spokesperson in a small company?
Usually the founder or a senior leader who is calm on camera and knows the facts. Choose one person and a backup, and give them basic media training.
Write your plan this week
Block two hours with your core team. Fill in the role table, list your six most likely scenarios, adapt the three holding statement templates, and save the CERT-In reporting details and your lawyer’s number on the same page. Rules and timelines change, so check official sources and take professional advice for your situation. The plan will not stop a crisis, but it will stop you from making it worse in the first hour.
