Cyber Risk Management – Legal Privilege Strategy – Part 1

An organization's cyber risk management activities may result in sensitive communications and documents that the organization's personnel expect will remain confidential. Nevertheless, in many circumstances an organization may be legally obligated to disclose those communications and documents unless the organization is able to assert a legal right — called "legal privilege" — to not make the disclosure. This two-part bulletin discusses legal privilege and cyber risk management. The first part of this bulletin discusses cyber risk reporting and disclosure obligations and the basic rules for legal privilege. The second part of this bulletin (available on July 27, 2016) provides practical recommendations for a legal privilege strategy for cyber risk management activities.