PR Crisis Response Checklist: The First 24 to 48 Hours

What to do in the first 24 to 48 hours of a PR crisis

In the first 24 to 48 hours of a PR crisis, your job is to confirm the facts, contain the spread, preserve the evidence, and say something short and accurate before others fill the silence. Assemble a small response team within the first hours, publish a holding statement once you know what you can stand behind, and only then decide which content can be corrected, reported, or removed. Speed matters, but a fast statement that later proves wrong does more damage than a careful one issued a few hours later.

This checklist is written for companies, executives, and public figures. It covers what to do hour by hour, the legal points that often get missed under pressure, and the mistakes that turn a bad day into a long crisis. It is general information, not legal advice. If a lawsuit, regulator, or data breach is involved, bring in your own attorney early.

Hours 0 to 2: confirm what is actually happening

The first instinct in a crisis is to respond. The better first move is to understand. Before anyone posts, replies, or calls a journalist back, answer these questions as precisely as you can:

• What exactly is being said, and where? A single viral post, a news article, a review wave, and a leaked document each call for a different response.
• Is it true, partly true, or false? Be honest internally. Your response strategy depends on this answer more than on anything else.
• Who is seeing it? Customers, employees, investors, regulators, and the press care about different things.
• How fast is it moving? Check whether the story is spreading across platforms or appearing in search results for your name or brand.
• Is anyone at risk? If there is a safety, health, or security issue, that comes before reputation.

Write the answers down in one shared document. It becomes the single source of facts for everyone who will speak on your behalf. If you need a framework for classifying incidents in advance, our guide to building a crisis management plan covers severity levels and decision rights.

Hours 0 to 4: assemble a small response team

A crisis team should be small enough to decide quickly and senior enough to have authority. For most organizations, that means:

• One decision-maker with final sign-off on every external statement.
• A communications lead who drafts statements and handles media.
• Legal counsel, internal or external, to review statements and flag disclosure duties.
• The operational owner of whatever went wrong, such as product, security, or HR.
• Someone monitoring social media, news, reviews, and search results in real time.

Agree on one spokesperson and tell everyone else, in writing, not to comment publicly or post about the issue on personal accounts. Unauthorized comments from employees are one of the most common ways a contained story becomes a bigger one. If you already have a crisis communication plan, this is the moment to open it and follow it.

Hours 0 to 6: preserve the evidence before it changes

Online content moves, gets edited, and disappears. If the crisis involves false statements, harassment, or a possible legal claim on either side, capture everything early:

• Take full-page screenshots that show the URL, the date, the author or account name, and engagement counts.
• Save the links themselves in a log, along with when and how you found each one.
• Archive comments and replies, not just the original post. They often show how the claim spread.
• Keep copies of any emails, messages, or calls from journalists, critics, or the person behind the content.

Preservation also applies to your own records. Once litigation is reasonably anticipated, parties are expected to keep relevant information. Under U.S. federal procedure, a court can order measures to cure the harm when electronically stored information that should have been preserved is lost because a party failed to take reasonable steps, and stronger sanctions are possible if the loss was intentional, as set out in Federal Rule of Civil Procedure 37(e). In practice, tell your team not to delete internal messages, posts, or files related to the issue, even embarrassing ones, until your lawyer says otherwise.

Hours 2 to 12: publish a holding statement

Silence is rarely neutral during a crisis. When you say nothing, critics, commentators, and search results define the story for you. A holding statement buys time without committing you to facts you have not yet confirmed. A good one usually does four things:

1. Acknowledges that you are aware of the issue.
2. Shows concern for anyone affected, without speculating about causes.
3. States what you are doing right now, such as investigating or pausing a product.
4. Commits to an update, ideally with a time frame you can keep.

Keep it short, factual, and consistent across every channel: your website, social accounts, and replies to reporters. Avoid admitting legal liability or attacking the critic before counsel has reviewed the wording.

Extra rules for public companies

Listed companies have disclosure duties that apply even in the middle of a crisis. Under Regulation FD, when an issuer intentionally shares material nonpublic information with certain market professionals or shareholders, it must make that information public at the same time, and promptly if the disclosure was unintentional. Briefing a few large investors privately before the public statement can create a separate problem. For cybersecurity incidents, the SEC said in its July 2023 announcement that a Form 8-K under Item 1.05 will generally be due four business days after the company determines the incident is material. Make sure your securities counsel is in the room before anything goes out.

If personal data was exposed

Data breaches carry their own legal clock. According to the National Conference of State Legislatures, all 50 states, the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands have laws requiring notice of security breaches involving personal information. Deadlines and content rules vary by state, so the communications plan has to fit the legal one, not the other way around.

Hours 12 to 24: sort the content into what can and cannot be removed

Once the immediate response is out, look at the content itself. Not everything harmful can be taken down, and treating every negative post as removable wastes time you do not have. A useful triage has three buckets:

• False statements of fact. Claims that are untrue and damaging may support a defamation complaint or a platform report. Our guides on defamation laws, libel vs. slander and defamation per se explain what a claim generally needs, and how to report defamation on social media covers platform reporting.
• Private or dangerous information. Home addresses, phone numbers, ID numbers, financial details, and similar data can often be reported. Google lets people request removal of certain personal information from its search results, although that does not remove it from the website itself. If your details are being spread to target you, read our guide on whether doxxing is illegal and on online harassment laws.
• Negative but lawful content. Honest criticism, fair reviews, and accurate reporting are usually protected. Here the realistic path is a strong response, corrected information, and stronger positive results, not removal.

Why the platform is not always the defendant

In the United States, Section 230 of the Communications Decency Act says a provider or user of an interactive computer service shall not be treated as the publisher or speaker of information provided by someone else. In practice, platforms generally are not liable for what their users post. That is why reports based on a platform’s own rules are often more effective than legal threats sent to the platform, while legal claims, where they exist, usually target the person who wrote the content.

Corrections from news outlets

If a news outlet published something inaccurate, ask for a correction in writing and keep the request factual. Some states also have retraction rules that affect a later claim. In California, for example, Civil Code section 48a covers daily or weekly news publications and radio broadcasts: a written demand for correction must be served within 20 days after learning of the publication, and a plaintiff who does not make that demand may be limited to special damages. Rules differ by state, so check the California defamation law page or the page for your state, and talk to a lawyer before sending anything that looks like a legal demand.

Be careful with aggressive legal threats against critics. In many states, a lawsuit aimed at protected speech can be challenged early under anti-SLAPP laws, and the person who sued may end up paying the other side’s legal fees.

Hours 24 to 48: correct the record and watch search results

By the second day, the news cycle may slow down, but search results start to settle. What ranks for your name or brand now can stay there for months. Use this window to:

• Publish the full update you promised. Explain what happened, what you found, and what you are changing. Put it on a page you control so it can rank for searches about the issue.
• Update owned profiles. Your website, social bios, and business listings should point to accurate information.
• Ask for edits where content has changed. If a publisher corrects or removes a page, the old version can linger in search for a while. Google explains in its guidance on removing information from Search that the lasting fix is to remove or update the page itself. Its Removals tool is open only to verified owners of a site, and it hides a URL for about six months without deleting the content.
• Set up ongoing monitoring. Track your name, brand, and key executives across news, social media, reviews, and search. Our guide to Google Alerts is a simple place to start.
• Brief employees and key partners. People closest to you should hear the facts from you, not from social media.

For crises that unfold mainly on social platforms, our guide to social media crisis management goes deeper into replies, moderation, and escalation.

Mistakes that make the first 48 hours worse

• Speculating in public. Every early detail you share and later retract becomes a second story.
• Deleting posts or comments in a panic. Screenshots outlive deletions, and removal can look like a cover-up or destroy evidence you need.
• Arguing with critics online. Heated replies tend to spread further than the original complaint.
• Letting several people speak. Mixed messages suggest confusion or concealment.
• Threatening to sue too early. A public legal threat can amplify the story and may expose you to an anti-SLAPP motion.
• Ignoring search results. The crisis may fade on social media while the worst article keeps ranking for your name.

Real cases show how quickly these mistakes compound. Our collection of PR crisis examples looks at what worked and what did not.

Your 24/48-hour crisis response checklist

1. Pause scheduled posts and campaigns that could look tone-deaf.
2. Confirm the facts and record them in one shared document.
3. Name a decision-maker, a spokesperson, legal counsel, and a monitoring lead.
4. Tell all staff who may comment publicly and who may not.
5. Screenshot and log every relevant post, article, and review with URLs and dates.
6. Instruct the team not to delete related internal records.
7. Check disclosure duties: securities rules, breach notification, contracts, insurers.
8. Publish a short holding statement and promise a specific update.
9. Sort harmful content into false, private, and lawful but negative.
10. Report content that breaks platform rules, and request corrections where facts are wrong.
11. Publish the full update on a page you own.
12. Monitor news, social media, reviews, and search results every day.
13. Debrief after the crisis and update your plan.

If you are unsure whether you need outside help, our guide on how to choose a crisis management firm explains what to look for, and our overview of crisis management covers the longer recovery.

How Media Removal can help

Media Removal is not a law firm, and we do not replace your lawyer or your PR agency. Our role is the online side of a crisis: what people find when they search for you, and what can be done about it. Through our reputation crisis management service, we respond the same day, assess which content is false, private, or in breach of platform rules, and pursue the right pathway for each item, whether that is platform reporting, publisher outreach, a deindexing request, or a legal channel handled with counsel.

Not everything can be removed. When content is lawful or a platform declines a request, we work on suppressing negative results and strengthening accurate information through online reputation management, and our content removal team handles takedowns where there are grounds for them. Outcomes depend on platforms, publishers, and sometimes courts, so we do not promise results. After the initial assessment, we give you a clear scope and a plan in writing, and every client signs an NDA, as do we.

If you are in the middle of a crisis right now, you can request a quote and tell us what is happening.

Frequently asked questions

What should be done in the first 24 hours of a PR crisis?

Confirm the facts, assemble a small response team with one spokesperson, preserve evidence of what is being published, check any legal disclosure duties, and publish a short holding statement that acknowledges the issue and promises an update. Decisions about removing or reporting content come after these first steps.

How quickly should a company respond publicly to a crisis?

As soon as you can say something accurate. Many teams aim for a holding statement within the first few hours, but it should only include facts you have confirmed. A fast statement that later proves wrong usually causes more harm than a careful one issued a little later.

What is a holding statement?

A holding statement is a short public message issued before all the facts are known. It acknowledges the situation, shows concern for anyone affected, explains what you are doing now, and commits to a further update. It buys time without committing you to details that may change.

Should we delete negative posts or comments during a crisis?

Usually not in a panic. Deleted content is often already captured in screenshots, deletion can look like a cover-up, and you may need the material as evidence. Preserve everything first, then decide with your team and counsel what to report, answer, or remove through proper channels.

Can harmful content about a crisis be removed from Google?

Sometimes. Content that is defamatory, exposes certain personal information, or breaks a platform’s rules may be removed at the source or from search results. Accurate reporting and honest criticism are usually protected, so the realistic approach there is correcting the record and strengthening positive results. Outcomes depend on the platform, the publisher, and in some cases a court.

When should we involve a lawyer in a PR crisis?

Early, if the crisis involves possible litigation, a data breach, a regulator, a public company disclosure, or statements you believe are defamatory. A lawyer can review your statements, flag disclosure deadlines, and advise on preservation duties before you say or delete anything.

Sources

• Federal Rules of Civil Procedure, Rule 37(e) (Cornell LII)
• 17 CFR 243.100, Regulation FD (Cornell LII)
• SEC press release 2023-139 on cybersecurity incident disclosure
• NCSL, Security Breach Notification Laws
• 47 U.S.C. 230 (Cornell LII)
• California Civil Code section 48a
• Google Search Help: Remove select personal information from Google
• Google Search Central: Remove information from Google Search
• Google Search Console Help: Removals tool