Most officers and directors could probably guess that they should immediately consult with counsel—both in-house and outside—upon learning that their company has been hit with a data breach. There are many decisions that need to be made early in the response process, including: whether and when to notify the authorities, when and how to notify those whose information may have been compromised and what steps must be taken to contain and remediate the breach. All of these decisions will be aided by the advice of experienced counsel familiar with the legal requirements surrounding data security.
Frank discussions between attorneys and their clients are critical to maintaining an effective partnership to protect the client’s legal rights. To that end, it’s important for companies to be able to use the attorney-client privilege and work-product doctrine to shield communications made for the purpose of obtaining legal advice—and documents created by their attorneys for the purpose of giving that advice. While the specific rules vary by jurisdiction, documents developed in the course of giving or obtaining legal advice are generally protected by the attorney-client privilege, the work-product doctrine or both. But information or documents produced for ordinary business purposes generally are not.
