Crisis communication by email: how to inform customers

Crisis communication by email means writing to customers quickly and clearly when something happens that affects them: a service outage, delivery delays, a price increase, a personal data breach or a product recall. Email is the most suitable channel for this, because it delivers the message directly to specific people and stays with them in writing. In a Sinch survey from July 2025, 73.9% of customers preferred email for service messages. A good crisis email answers six questions: what happened, who it affects, what you are doing, what the customer should do, where to find more information and when you will be in touch again. In this article you will find a six step process, three sample emails, your duties under the GDPR and the General Product Safety Regulation and what to do with scheduled campaigns in Quanda.

In brief

1. Send the crisis email as a simple campaign. Quanda delivers it to the vast majority of recipients within roughly 5 to 15 minutes.
2. First pause scheduled campaigns, series and automations so that a cheerful offer does not go out next to your crisis email.
3. A crisis email answers six questions and sells nothing.
4. You must tell the people affected about a high risk personal data breach without undue delay, and the authority within 72 hours.
5. Since December 2024, a recall notice for a dangerous product has a mandatory headline and content and must not play down the risk.
6. Once it is all over, close the situation with a follow up email.

In short: when to write, to whom, what to say and what happens if you stay silent

• When to write: as soon as you know what happened and who it affects, not once everything is resolved.
• To whom: only the customers the crisis affects. For an outage, all users of the service, for a recall, everyone who bought the product.
• What to say: what happened, who it affects, what you are doing, what the customer should do, where to find more information and when you will be in touch again.
• What happens if you stay silent: customers learn about the problem elsewhere, lose trust, and with a data breach or a dangerous product you break a legal obligation.

What has changed since publication: The original article from June 2020 explained why email proved its worth during the coronavirus crisis. In October 2026 we rewrote it into a practical guide for any crisis: it now has a six step process, sample emails, duties under the GDPR and the General Product Safety Regulation and current data on which channels customers prefer.

What crisis communication by email is

Crisis communication is the way a company informs customers and other people in a situation that threatens their interests or their trust in the company. A crisis email is a message you send in such a situation to the customers the crisis affects. It is not about selling, but about information the customer needs to know what is going on and what to do.

A crisis does not have to be a disaster. For a customer, a crisis is anything that makes life harder and that they should hear about from you:

• an outage of your online shop, app or another service,
• delivery delays or cancelled orders,
• a price increase or a change of terms,
• a mistake in an email you sent, such as a wrong price or a discount code that does not work,
• a personal data breach,
• a product recall for safety reasons,
• a natural disaster that limits your operations.

Why email is the best channel in a crisis

Email is the best channel in a crisis because it delivers the message directly to the people it concerns and stays with them in writing. On social media, an algorithm decides the reach and only some followers see the post, often including people the problem does not affect at all. Phoning hundreds of customers is not possible. You can send an email in a few minutes to exactly the people you need, and everyone can read it again when deciding what to do next.

Customers see it the same way. Data from recent surveys:

Source: Sinch, 2025 BFCM consumer survey (July 2025); Pureprofile survey for Intuit Mailchimp (July 2025).

Email has one more advantage in a crisis: it is your channel. You manage your contact database yourself, you know who bought what, and you can write only to the customers affected. You do not need to worry the others.

When to send a crisis email: an overview of situations

Send a crisis email whenever a customer learns or should learn about a problem. It is better if they hear it from you than from reviews, social media or the news. In two situations, the law requires it directly.

Source: Regulation (EU) 2016/679 (GDPR), Articles 33 and 34; Regulation (EU) 2023/988 on general product safety (GPSR), Articles 35 and 36.

How to write a crisis email: 6 steps

You write a crisis email in six steps: stop scheduled campaigns, decide who the crisis affects, write a clear subject line, answer six questions, send the email in the name of a specific person and finally close the situation with a follow up email.

Step 1: Stop scheduled campaigns

Pause all campaigns, series and automations that would go out in the coming days and would seem insensitive next to the crisis. A cheerful newsletter with a discount that arrives the day after a data breach notice damages trust more than the problem itself. What exactly pausing stops in Quanda depends on the type of campaign, see the overview in the section Crisis communication in Quanda.

Step 2: Decide who the crisis affects

Decide which customers you must write to and select them in your database with a tag or a filter. A service outage affects all of its users, a delay only customers with an open order, a recall only those who bought the product. The more precisely you choose the recipients, the fewer people you will alarm needlessly.

Be careful with contacts you have not written to for a long time. If you suddenly email your whole old database, more addresses will bounce and the email may end up in spam. Why this happens is explained in the article Reasons for undelivered emails.

Step 3: Write a subject line that says what it is about

In the subject line, say what happened and that this is important information, without jokes and without marketing words. The subject line of a crisis email has the same job as a news headline: the recipient should know straight away why to open it.

More tips for subject lines are in the article How to write an email subject line people actually open.

Step 4: Answer six questions

In the body of the email, say what happened, who it affects, what you are doing, what the customer should do, where to find more information and when you will be in touch again. In this order, in short sentences and without jargon.

1. What happened: one or two sentences, facts without playing anything down.
2. Who it affects: whether it affects the recipient too and to what extent.
3. What you are doing: concrete steps that are already under way.
4. What the customer should do: a clear instruction or explicitly “you do not need to do anything”.
5. Where to find more information: a page on your website that you will keep updating and a contact person.
6. When you will be in touch again: a specific day or event, for example “as soon as the service is running again”.

If you caused the problem, apologise in one sentence and without excuses. The apology should not delay what matters.

Step 5: Send the email in the name of a specific person

Choose a sender whom customers know, set a reply address that someone reads and send yourself a test email. A crisis email from the owner or the head of customer care feels different from a message from “The XY Company Team”. People will reply and ask questions, so make sure someone is ready to respond.

In Quanda, you choose the sender in the campaign mailing settings. It can be any user with a verified email address. You send yourself a test email from the same page, and before sending you click through all the links in it.

Step 6: Close the situation with a follow up email

Once the crisis is resolved, send the same people an email about what you found out, what you fixed and what you will do so that it does not happen again. The follow up email is as important as the first one. Without it, customers are left wondering how it all turned out. Only after it should you resume your regular campaigns.

Crisis email templates

The crisis email templates below show how to use the six questions in three typical situations. Replace the text in square brackets with your own details.

Personal data breach: what the GDPR says

A personal data breach under the GDPR is a situation in which personal data is accidentally or unlawfully destroyed, lost, altered or disclosed without authorisation. This includes a hacked online shop, a lost laptop with a customer database and an email with a contact spreadsheet sent to a stranger by mistake.

The GDPR distinguishes two obligations:

Source: Regulation (EU) 2016/679 (GDPR), Article 33(1) and (3) and Article 34(1) to (3).

You do not have to write to the people affected if the data was protected so that it is unintelligible to others, typically by encryption. You do not have to either if you have taken measures after which the high risk is no longer likely to materialise. If individual notices would involve disproportionate effort, a public announcement that is equally effective replaces them.

The 72 hour deadline runs from the moment you became aware of the breach. If you miss it, you must give the reasons for the delay in your notification. You may provide information you do not have yet in phases. Also document every breach, even if you do not report it to the authority.

Warning: A data breach is often followed by fraudulent emails pretending to be notices from the company affected. So do not put a login link or a request to enter a password in your own notice. On the contrary, say explicitly that you will never ask customers for anything like that.

How Quanda protects the personal data of your contacts and what it does when a problem concerns it as a processor is summarised in the article Quanda and GDPR.

Product recall: obligations under the GPSR

The General Product Safety Regulation (GPSR) is EU Regulation 2023/988 which, since 13 December 2024, governs among other things how to inform customers about a dangerous product. It applies to manufacturers, importers, distributors and online marketplaces.

If you recall a product for safety reasons, Article 35 requires you to inform all affected customers you can identify directly and without undue delay. You are explicitly required to use the customer contact details you collect for this. Where you cannot reach everyone, you spread the notice by other means as well, such as your website, social media, newsletters and shops.

A written notice, including an email, must contain the following under Article 36:

• the headline “Product safety recall”,
• a description of the product: a picture, name, brand, batch or serial number and when, where and by whom it was sold,
• a clear description of the hazard,
• what customers should do, including an instruction to stop using the product immediately,
• what remedy you offer, for example repair, replacement or a refund,
• a freephone number or an interactive online service for more information,
• where appropriate, a request for customers to share the information with others.

Warning: The notice must not play down the risk. The regulation explicitly prohibits terms such as “voluntary”, “precautionary”, “discretionary”, “in rare situations” or “in specific situations” as well as saying that no accidents have been reported.

What does not belong in a crisis email

Nothing that distracts from the information or reduces trust belongs in a crisis email:

• An offer or discount code: a crisis email is not a sales opportunity. Offer compensation if it is appropriate, but not as a marketing trick.
• Playing things down and vagueness: customers will read “minor technical issues” for an outage that lasted half a day as untrue.
• Jargon: customers do not need to know what a server or a database is, they need to know what it means for them.
• A login link: after a data breach it helps fraudsters.
• A noreply address: people reply in a crisis. If nobody reads the replies, the crisis moves to the phones and social media.
• Too many emails: send new information, not repetition. The first email, an update if needed and a closing email are enough.

General principles for writing texts people read to the end are in the article Email copywriting: how to write copy people actually read.

Crisis communication in Quanda

In Quanda you handle crisis communication in three steps: pause scheduled campaigns, select the contacts affected and send a simple email campaign. Quanda delivers the vast majority of a sent campaign's emails to inboxes within roughly 5 to 15 minutes. You pause a campaign on its Settings page: set the Status field to Paused and save the change. What pausing stops depends on the type of campaign:

Tip: Send the crisis email as a simple campaign and choose the recipients with a tag or a filter. If you do not have the affected customers distinguished in Quanda, add a tag to them by import, for example from a list of orders from your online shop.

Unsubscribed contacts. Quanda always leaves contacts who have unsubscribed out of campaign recipients. If you need to send them a service notice, for example about a breach of their data, you have two options. The first is a transactional email sent through the API, which bypasses the unsubscription. The second is switching the status of specific contacts manually and then sending the email. Such a message may contain only information the customer really needs, no offer.

Checklist before sending a crisis email

Check before sending:

• Scheduled campaigns, series and automations are paused.
• The email goes only to the customers the crisis affects.
• The subject line says what happened and contains no marketing words.
• The text answers six questions: what happened, who it affects, what we are doing, what the customer should do, where to find information and when we will be in touch.
• The sender is a specific person and someone reads the replies.
• The email contains no offer and no login link.
• The page with details on the website is ready and the link works.
• For a data breach, the notification to the authority has been made or is ready, for a recall the notice has all the elements required by the GPSR.
• I have sent myself a test email and read it through the customer's eyes.
• I know when I will send the follow up email.

In conclusion

A crisis cannot always be prevented, but it can be handled so that customers trust you more than before. What matters is speed, openness and whether the customer knows what to do. Prepare your crisis email in advance as a template, and when a crisis comes you will only fill in the facts.

How to save an email template in Quanda is explained in the article Email template: how to create, save and reuse it. This article is not legal advice, so have your data breach or recall notice checked by a lawyer. If you need help setting up your account, write to us at support@onquanda.com, call +420 605 163 892 or book a free consultation.