This puts board members in an unfortunate situation of trying to deal with a situation of weakness without a roadmap. These events can also trigger a reflex reaction from the board of directors to hastily create a new privacy policy. The directive should contain a statement of the directors` obligation of confidentiality and declare that they may not disclose, discuss or use confidential information about the affairs of the corporation with any other person or organization unless authorized to do so by the board of directors. This section should include that no statement will be made to the media or the public without the prior authorization of the Board of Directors. .