Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button

Category: Legal & Investigations

Attorney-Client Privilege

Also known as: Legal Professional Privilege, Lawyer-Client Privilege

Simply put

Attorney-client privilege is a legal protection that allows a client to keep confidential communications with their lawyer private and to prevent others from forcing their disclosure. Its purpose is to encourage clients to speak openly and honestly with their attorneys without fear that those conversations will be revealed. This candor is intended to help clients obtain sound legal advice.

Formal definition

Attorney-client privilege is a client's right to refuse to disclose, and to prevent others from disclosing, confidential communications made between the client and their attorney for the purpose of obtaining or providing legal advice. The privilege exists to encourage free and candid discussion between lawyer and client, on the rationale that clients will more readily seek and follow legal advice when assured their communications are protected. The privilege typically belongs to the client and generally protects the confidential communication itself rather than underlying facts; its precise scope, exceptions (such as waiver or the crime-fraud exception), and application vary by jurisdiction and by whether the setting is judicial, regulatory, or investigatory. Practitioners should note that the availability and boundaries of the privilege are matters of legal interpretation that depend on the applicable jurisdiction and facts, and this definition does not constitute legal advice.

Why it matters

Attorney-client privilege sits at the intersection of governance and compliance because it shapes how organizations seek, document, and act on legal advice. In an environment where internal investigations, regulatory inquiries, and litigation are routine, the ability to communicate candidly with counsel without fear of forced disclosure is often what allows leadership to understand its true legal exposure and make informed decisions. Where privilege is preserved, boards and management can obtain frank assessments; where it is inadvertently waived or never properly established, sensitive communications may become discoverable in a way that complicates a defense or an examination.

For GRC professionals, the practical stakes are high because the privilege protects the confidential communication itself rather than the underlying facts. This means that unfavorable facts do not become hidden simply because they are discussed with a lawyer, and organizations should not assume that routing a document through counsel automatically shields it. The privilege belongs to the client, and its precise scope, exceptions such as waiver and the crime-fraud exception, and its application in judicial, regulatory, or investigatory settings vary by jurisdiction and by the specific facts.

Because the availability and boundaries of the privilege are matters of legal interpretation, missteps in handling privileged material can carry consequences that are difficult to reverse. Careful attention to who is a client, what constitutes a communication for the purpose of legal advice, and how confidentiality is maintained is therefore a governance concern that extends well beyond the legal department alone. Specifics should always be verified against applicable law with qualified counsel.

Who it's relevant to

General Counsel and Legal Teams

In-house and external counsel are central to establishing and preserving privilege, since it protects confidential communications made for the purpose of giving or obtaining legal advice. They are responsible for structuring communications, managing confidentiality, and advising on where waiver or exceptions such as the crime-fraud exception may apply, recognizing that scope varies by jurisdiction and setting.

Compliance Officers

Compliance professionals frequently interact with counsel during internal investigations and regulatory inquiries, where whether a communication is privileged can affect how findings are documented and disclosed. Because the privilege protects the communication rather than the underlying facts, compliance teams should not assume that involving a lawyer shields information, and should coordinate with counsel on handling sensitive material.

Boards and Senior Management

The privilege generally belongs to the client, which in an organizational context raises questions about who holds and can waive it. Directors and executives rely on candid legal advice to understand exposure and make decisions, so they have a governance interest in how privileged communications are created, protected, and potentially waived.

Internal Auditors and Investigators

Those conducting internal reviews often work alongside legal teams and may generate documents that touch on legal advice. Understanding that privilege depends on confidentiality and legal-advice purpose, and that it can be waived, helps them handle work product appropriately and defer to counsel on questions of scope and interpretation.

Inside Attorney-Client Privilege

Confidential Communication

The privilege typically protects communications made in confidence between a client and their attorney. The communication must generally be intended to be confidential at the time it was made; broad or indiscriminate disclosure to third parties often undermines that expectation of confidentiality.

Attorney-Client Relationship

The protection generally applies to communications with a lawyer acting in their professional legal capacity, or with someone the client reasonably believes to be a lawyer. Communications made when the attorney is acting in a purely business, administrative, or non-legal role may fall outside the privilege's scope.

Purpose of Seeking Legal Advice

The communication is typically protected where its purpose is to seek or provide legal advice. In many jurisdictions, communications made primarily for business advice rather than legal advice are not covered, and the dominant purpose of the communication is often a determining factor.

Holder of the Privilege

The privilege generally belongs to the client, not the attorney, and the client is typically the party entitled to assert or waive it. In an organizational context, identifying who speaks for the entity as the client can be a matter of law that varies by jurisdiction.

Waiver

The privilege can typically be lost through waiver, which may occur by voluntary disclosure of the protected communication to third parties or, in some circumstances, inadvertently. Whether and how waiver applies is context-dependent and often governed by jurisdiction-specific rules.

Scope and Exceptions

The privilege is generally not absolute. Commonly recognized limits include the crime-fraud exception, under which communications made in furtherance of a crime or fraud are typically not protected. The precise contours of exceptions vary by jurisdiction and require professional legal advice to apply to specific facts.

Common questions

Answers to the questions practitioners most commonly ask about Attorney-Client Privilege.

Does attorney-client privilege protect any communication involving a lawyer?

No. The privilege typically protects confidential communications made for the purpose of seeking or providing legal advice, not every interaction that happens to include a lawyer. Communications concerning business, strategic, or operational matters, rather than legal advice, often fall outside its scope, even when an attorney is copied or present. Because the boundary between legal and business advice can be contested and varies by jurisdiction, whether a specific communication qualifies is frequently a matter of legal interpretation that requires professional advice.

If a document is marked 'privileged and confidential,' is it automatically protected?

Not necessarily. A label does not by itself create privilege; the underlying communication must meet the applicable legal criteria, which generally include confidentiality and a purpose connected to legal advice. Over-labeling routine business documents can undermine credibility if privilege claims are later challenged. Whether protection actually applies depends on the substance of the communication and the governing jurisdiction, not the marking alone, and contested claims often turn on legal interpretation.

How can an organization reduce the risk of inadvertently waiving privilege?

Common leading practices include limiting distribution of legal advice to those with a genuine need to know, keeping legal advice separate from business discussion where feasible, and being cautious about forwarding or summarizing privileged content into wider circulation. Because waiver rules and their consequences vary by jurisdiction, organizations often coordinate such practices with counsel rather than relying on generic policies. This is guidance rather than a guarantee, and specific waiver questions should be verified with legal advisors.

How should privilege be handled when in-house counsel provides advice?

Whether communications with in-house counsel attract privilege can depend on jurisdiction, the counsel's role, and whether the communication was for legal rather than business purposes. Some jurisdictions treat in-house legal advice differently from external counsel advice. Organizations often address this by clarifying when in-house lawyers are acting in a legal capacity and documenting that context. Because treatment varies significantly, the applicable rules in each relevant jurisdiction should be confirmed with qualified counsel.

What role can privilege considerations play in an internal investigation?

Internal investigations are sometimes structured so that legal advice and investigative work product may be eligible for protection, which can affect how information is gathered, documented, and shared. However, eligibility is context-dependent and not automatic, and disclosing findings to third parties or regulators may affect any protection that applies. The scope and durability of protection in this setting is a matter of legal interpretation, so investigation design typically involves counsel from the outset.

How does privilege interact with regulatory disclosure or cooperation obligations?

Privilege and regulatory disclosure obligations can be in tension, and how they are reconciled depends on jurisdiction, sector, and the specific regulator involved. Choosing to disclose privileged material, sometimes described as a waiver, may satisfy a cooperation expectation but can also affect the protection of related communications. Because the consequences vary and can be significant, decisions about disclosing privileged material are generally made with legal advice rather than as a routine compliance step.

Common misconceptions

Copying a lawyer on an email automatically makes the communication privileged.

Merely including an attorney as a recipient does not, on its own, confer privilege. The communication typically must be for the purpose of seeking or providing legal advice and made in confidence; routine business communications shared with a lawyer are often not protected.

The privilege belongs to the attorney and the attorney decides whether to disclose.

The privilege generally belongs to the client, who typically holds the right to assert or waive it. The attorney ordinarily has a duty to protect it on the client's behalf rather than a right to waive it unilaterally.

Attorney-client privilege protects all communications with counsel without exception.

The privilege is generally not absolute. It can be waived and is subject to recognized exceptions such as the crime-fraud exception, and its application varies by jurisdiction and by whether the communication was truly for legal advice.

Best practices

Clearly delineate legal advice from business or administrative communications, and avoid routinely copying counsel on matters that are not genuinely seeking legal advice, since privilege often turns on the dominant purpose of the communication.

Limit distribution of privileged communications to those who need to receive them, as broad or indiscriminate disclosure can undermine the confidentiality on which the privilege typically depends.

Establish clear protocols for who within an organization is authorized to communicate with counsel and to assert or waive privilege, since in an organizational context the identity of the client is a matter of law that varies by jurisdiction.

Be cautious about inadvertent waiver, including through forwarding, sharing, or attaching privileged material to communications with third parties, and confirm the applicable jurisdiction's rules on inadvertent disclosure.

Recognize that recognized exceptions, such as the crime-fraud exception, can defeat the privilege, and do not treat the privilege as an absolute shield for any communication.

Consult qualified legal counsel to assess privilege questions for specific facts, as the scope, waiver rules, and exceptions are context-dependent and vary by jurisdiction.