What role does legal privilege play in cyber incident response?

Legal privilege in cyber incident response is a rule that can protect certain confidential communications and materials from disclosure in legal proceedings. Its application depends on the purpose of the communication, who is involved, the capacity in which they are acting and whether confidentiality is maintained. A document is not privileged simply because it concerns a cyber attack or is marked “privileged and confidential”.

In the UK, two forms of privilege are particularly relevant:

• Legal advice privilege applies to confidential communications between a lawyer and their client made for the purpose of giving or receiving legal advice. The advice may cover issues such as reporting duties, contractual obligations, regulatory exposure, evidence preservation and potential claims.
• Litigation privilege can apply to confidential communications between a lawyer, client and relevant third parties when litigation is reasonably in contemplation and the communication is created for the dominant purpose of conducting that litigation. This can include material prepared by technical specialists, but only where the legal requirements are satisfied.

The distinction matters because much of an incident response involves operational activity rather than legal advice. Containment decisions, system recovery, vulnerability remediation, business continuity and routine technical updates will not automatically become privileged because a solicitor is copied into an email or because a report was requested during the incident.

Privilege belongs to the client. The client can generally choose to maintain it, waive it or disclose privileged material. Waiver may be express, such as deliberately providing a report to another party, or implied through conduct that is inconsistent with keeping the material confidential. Once privilege is waived, the protection may extend beyond the specific extract or document that was shared, depending on the circumstances.

For that reason, a business should treat the handling of privileged material as a governance issue, not merely an email-management preference. A practical response structure may include:

1. Separating legal and operational workstreams. Legal advice, factual investigation, executive decision-making and technical remediation should have clearly defined purposes and records. This makes it easier to identify which communications are being created for legal advice and which are ordinary business documents.
2. Controlling circulation. Privileged advice should be shared only with people who need it for the relevant legal or response purpose. Broad distribution, forwarding outside the response team or copying it into general meeting notes can make the confidentiality position more difficult to defend.
3. Recording purpose accurately. A solicitor should determine whether a request is for legal advice, litigation preparation or ordinary incident management. Labels can assist with handling, but they do not create privilege where the underlying legal test is not met.
4. Managing technical experts carefully. A forensic investigator or other specialist may be engaged to help a lawyer provide legal advice or prepare for litigation. The engagement terms, instructions, reporting line and purpose of the work should be considered together. A technical report prepared for ordinary security improvement is not transformed into privileged material merely by routing it through legal counsel.
5. Preserving the underlying evidence. Privilege does not remove the need to preserve logs, system images, access records, emails and other relevant evidence. It protects qualifying communications and material, not the underlying facts about what happened.

Internal communications require particular care. Employees are not normally treated as the client for every communication involving a lawyer, and an internal email discussing legal advice may not itself be protected. In-house lawyers also need to be acting in a legal capacity for the communication to attract legal advice privilege; advice that is primarily commercial, managerial or technical may fall outside that protection. A business should therefore avoid using legal privilege as a general label for all executive discussions about an incident.

Privilege also does not remove statutory or contractual duties. A business may still need to assess whether it must notify a regulator, affected individuals, customers, insurers, contractual partners or law enforcement. The fact that a notification decision was discussed with a lawyer does not necessarily make the notification itself privileged. Sharing advice or investigation material with an insurer, regulator or other third party should be considered carefully, because disclosure can affect confidentiality and waiver.

Nor does privilege protect pre-existing documents simply because they are collected for a legal review. Existing contracts, emails, system logs and business records do not generally acquire privilege merely by being sent to a solicitor. A new analysis or communication created for a qualifying legal purpose may have a different status, but the original document remains subject to its own disclosure position.

Businesses should also distinguish between a privileged legal assessment and a factual incident report. A factual report may be needed for governance, insurance, customer assurance, remediation or regulatory engagement. Trying to make every record privileged can reduce transparency and create uncertainty about whether important evidence has been properly retained. The better approach is to decide the purpose of each record before it is created and to obtain specific legal advice where the position is uncertain.

At the end of an incident, the privilege position should be reviewed alongside the evidence register, notification decisions and lessons-learned process. Remediation actions and technical findings may need to be shared with management or service providers even if related legal advice remains confidential. Keeping those outputs distinct helps the business use legal advice appropriately without treating privilege as a barrier to effective security improvement.

Legal privilege can therefore support a controlled cyber incident response, but it is not a shield for the entire investigation. Its value comes from disciplined purpose, limited circulation, accurate records and careful coordination between legal advisers, technical specialists, executives and any relevant third parties.