Two Simple Ways to Maximize Privilege and Work Product Protections in Data Breach Investigations

Data breach incident investigation materials are not automatically protected from discovery in civil litigation or government investigations. Whether such materials are protected from discovery can have serious cost and public relations implications for a company that has become a victim of a data breach and the target of resultant civil litigation and/or government regulatory investigations. In the wake of dozens of post-breach lawsuits and investigations over the last year alone, it has become clear that steps taken on the front end by the General Counsel can make all the difference.

The first step in establishing and preserving privilege and work product protections over a data breach investigation is to involve the GC in the development of an incident response plan. As a best practice, the GC’s office should play a lead role in the formation and implementation of a data breach incident response plan before a data breach takes place. This will enable the company to best prepare for the likely legal (as well as financial and business) fallout of a data breach – notably by being mindful of, and taking definitive steps to maximize, the protections provided by attorney-client privilege and work product protections pertaining to a data breach investigation’s findings.