Legal privilege does not make incident facts disappear
Running an investigation under privilege can protect the advice. It does not change what happened or remove reporting duties.
The facts remain reportable to regulators, and privilege can be lost or challenged. It is a legitimate tool, frequently reached for reflexively, and it sometimes makes the technical response worse by restricting who may be told what. It is a legal decision with operational consequences that deserve weighing.
More on Regulation and law
- Regulatory scope is a security architecture questionThe rope follows the wire
- Incident reporting deadlines change response prioritiesThe clock starts with the incident
- DORA makes ICT third-party resilience a contractual and oversight responsibility for regulated financial entitiesThe work moves, the answering stays
- Under NIS2, an organisation's sector, size and role can determine whether cybersecurity risk-management and reporting duties applyThree flaps, one outcome
- Breach notification and incident notification are different testsTwo holes, two different shapes
- Regulation can make suppliers part of your compliance systemTheir controls, on your sheet